Executive brief
Iris is a web-based platform used by incident responders to collaborate and share technical details during security investigations. A vulnerability in the login system allows attackers to create deceptive links that redirect users to malicious websites after they log in. This could be used in phishing campaigns to steal credentials or deliver malware by tricking users into thinking they are still on a trusted corporate platform.
Technical details
An open redirect vulnerability exists in the Iris web application due to insufficient validation of the 'next' parameter during the login process. An unauthenticated remote attacker can craft a URL containing a malicious domain in the redirect parameter (e.g., /login?next=attacker.com). When a victim clicks the link and successfully authenticates, the application issues a 302 redirect to the attacker-controlled site. This is classified as CWE-601 (URL Redirection to Untrusted Site) and was addressed in version 2.4.28 by implementing stricter input validation on redirect targets.
Affected products
- DFIR-IRIS iris-web < 2.4.28
Timeline
- 2026-01-26: other: Vulnerability identified by researchers
- 2026-01-30: other: Initial vendor contact
- 2026-04-27: patched: Version 2.4.28 released with fix
- 2026-05-28: advisory: GitHub security advisory published
- 2026-06-04: disclosed: NVD publication date