What is the CVSS score of CVE-2026-16970?

CVE-2026-16970 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

DFIR-IRIS CVE-2026-16970

EUVD-2026-51074 MEDIUM

Insufficient Session Expiration (CWE-613)

2026-07-30 sba-research

GHSA-7wv8-chjv-grqm

Information Disclosure Iris Web Dfir Iris

4.2

CVSS 3.1 · Vendor: sba-research

Severity by source

Vendor (sba-research) PRIMARY

4.2 MEDIUM

AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

Cookie reuse occurs over the network (AV:N); AC:H reflects required prior cookie theft; UI:R because victim must log out to trigger the expectation gap; C:H for full session-scoped data access.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (sba-research).

CVSS VectorVendor: sba-research

Attack Vector

Physical

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 10:22 vuln.today

DescriptionCVE.org

The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time.

AnalysisAI

DFIR-IRIS web application version 2.4.26 implements logout without server-side session invalidation, leaving session cookies valid indefinitely after a user believes they have signed out. Classified as CWE-613 (Insufficient Session Expiration), this flaw means any attacker who obtains a valid session cookie - through XSS, network interception, shoulder-surfing, or physical device access - retains unauthorized access to the IRIS incident response platform even after the legitimate user logs out. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

DFIR-IRIS (cpe:2.3:a:dfir-iris:iris-web:*:*:*:*:*:*:*:*) is a collaborative web-based Digital Forensics and Incident Response case management platform. The root cause is CWE-613 (Insufficient Session Expiration): upon logout, the application fails to invalidate the server-side session token, so the cookie issued at login remains cryptographically valid and accepted by the server indefinitely or until natural expiration. Properly implemented logout must both clear the client-side cookie AND revoke the corresponding server-side session record. The absence of the server-side revocation step is the architectural defect here. Because DFIR-IRIS handles sensitive investigative data - case notes, evidence artifacts, analyst activity - the confidentiality impact of persistent cookie reuse is high within the application's data scope.

RemediationAI

No exact patched version number was provided in the available data. Organizations should consult the sba-research advisory at https://github.com/sbaresearch/advisories/tree/public/2026/SBA-ADV-20260128-04_DFIR-IRIS_Insufficient_Logout and monitor the DFIR-IRIS GitHub repository for a patched release that implements server-side session invalidation on logout. As a compensating control, administrators can configure aggressive session timeout values at the server or reverse-proxy layer (e.g., set session TTL to 15-30 minutes) to reduce the window of exposure for stolen cookies - note this introduces usability trade-offs requiring frequent re-authentication. Additionally, enforcing HTTPS everywhere (eliminating cleartext cookie transmission) and deploying Content Security Policy headers reduce the likelihood of cookie theft via MITM or XSS, addressing the precondition rather than the logout flaw itself. Restricting IRIS access to VPN or allowlisted IP ranges further limits the ability of an attacker to reuse a stolen cookie from an arbitrary location.