Description
The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dfir-iris | iris-web | 2.4.26 | — |
Medium · 5.9
CVE-2026-18362
EUVD-2026-51073GHSA-qx8j-r79q-xq3m
DFIR-IRIS Missing Brute Force Protection in User Authentication
Published Jul 30, 2026 · Updated Jul 30, 2026 · Assigned by sba-research