Description
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dfir-iris | iris-web | 2.4.26 | — |
Medium · 5.9
CVE-2026-16971
EUVD-2026-51072GHSA-rgg5-4fcv-9382
DFIR-IRIS Missing Brute Force Protection in OTP Validation
Published Jul 30, 2026 · Updated Jul 30, 2026 · Assigned by sba-research