EUVD-2026-51072
GHSA-rgg5-4fcv-9382
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H encodes the prerequisite of valid credentials; PR:N because the MFA endpoint is pre-authentication; C:H for full access to sensitive DFIR data; I:N and A:N as brute-force bypass causes no direct write or disruption.
Primary rating from Vendor (sba-research).
CVSS VectorVendor: sba-research
Lifecycle Timeline
1DescriptionCVE.org
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.
AnalysisAI
Missing rate-limiting on MFA validation in DFIR-IRIS 2.4.26 allows a remote attacker who possesses valid user credentials to systematically enumerate multi-factor authentication codes until the correct value is found, bypassing the second authentication factor and gaining unauthorized access to the DFIR investigation platform. The CVSS vector scores High confidentiality impact with no integrity or availability penalty, reflecting full read access to sensitive incident response and forensic investigation data. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
Technical ContextAI
DFIR-IRIS (CPE: cpe:2.3:a:dfir-iris:iris-web:*:*:*:*:*:*:*:*) is a collaborative digital forensics and incident response web platform designed for security operations teams. The vulnerability is rooted in CWE-770 (Allocation of Resources Without Limits or Throttling), meaning the application's MFA validation endpoint imposes no rate limiting, request throttling, attempt counters, or account lockout after repeated failed submissions. Time-based one-time passwords (TOTP) are typically 6 digits and rotate every 30 seconds, yielding a search space of 1,000,000 codes per window; without throttling, an attacker can exhaust a significant portion of the valid window programmatically. The 'Denial Of Service' tag alongside CWE-770 suggests the same unrestricted endpoint may also be abusable for resource exhaustion, though the CVSS vector does not score availability impact, indicating the primary concern is authentication bypass rather than service disruption.
RemediationAI
No vendor-released patch version has been identified in the available data. The primary remediation reference is the SBA Research advisory at https://github.com/sbaresearch/advisories/tree/public/2026/SBA-ADV-20260128-02_DFIR-IRIS_Missing_Brute_Force_Protection, which should be checked for any coordinated patch release or upstream fix. As compensating controls pending a patch, operators should implement rate limiting on the MFA validation endpoint at the reverse proxy or WAF layer (e.g., nginx limit_req or a cloud WAF rule), restricting to a maximum of 5-10 attempts per source IP per minute - note this may trigger false positives for users behind shared NAT. Enforcing account lockout or a mandatory TOTP re-challenge delay after 5 failed MFA attempts at the application level, if configurable, would directly address the root cause. Restricting IRIS web access to VPN or allowlisted IP ranges is the most effective compensating control and eliminates network-reachable exposure entirely, with the trade-off of reducing accessibility for remote responders. Monitor authentication logs for repeated MFA failures from the same source as a detection signal.
Stored cross-site scripting in the DFIR-IRIS incident-response platform (iris-web 2.4.26 and possibly earlier) lets an a
Stored cross-site scripting in DFIR-IRIS (iris-web) version 2.4.26 and possibly earlier lets an authenticated, low-privi
Stored cross-site scripting in the DFIR-IRIS incident-response platform (iris-web 2.4.26 and possibly earlier) lets an a
Missing brute-force protection on the DFIR-IRIS web application's authentication endpoint exposes version 2.4.26 (and po
DFIR-IRIS web application version 2.4.26 implements logout without server-side session invalidation, leaving session coo
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today