CVE-2026-16970: CWE-613 Insufficient session expiration in dfir-iris iris-web
The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time.
AI Analysis
Technical Summary
The IRIS web application (iris-web) version 2.4.26 contains a vulnerability classified as CWE-613 (Insufficient Session Expiration). The logout mechanism does not properly invalidate session cookies, which means that if an attacker obtains a session cookie, they can continue to use it for a prolonged time without being logged out. This flaw affects session management security and can lead to unauthorized access.
Potential Impact
An attacker who steals a valid session cookie can maintain unauthorized access to the application for a long duration due to ineffective logout and session expiration controls. This compromises confidentiality but does not affect integrity or availability according to the CVSS vector.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious with session cookie handling and consider additional session management controls if possible.
CVE-2026-16970: CWE-613 Insufficient session expiration in dfir-iris iris-web
Description
The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time.
CVSS v3.1
Score 4.2medium
Affected software
dfir-iris
iris-web
pkg:github/sbaresearch/iris-webRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The IRIS web application (iris-web) version 2.4.26 contains a vulnerability classified as CWE-613 (Insufficient Session Expiration). The logout mechanism does not properly invalidate session cookies, which means that if an attacker obtains a session cookie, they can continue to use it for a prolonged time without being logged out. This flaw affects session management security and can lead to unauthorized access.
Potential Impact
An attacker who steals a valid session cookie can maintain unauthorized access to the application for a long duration due to ineffective logout and session expiration controls. This compromises confidentiality but does not affect integrity or availability according to the CVSS vector.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious with session cookie handling and consider additional session management controls if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- sba-research
- Date Reserved
- 2026-07-24T08:24:41.455Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a6b22899c2644c7f8e40a9f
Added to database: 07/30/2026, 10:08:09 UTC
Last enriched: 08/06/2026, 13:49:46 UTC
Last updated: 09/13/2026, 22:01:32 UTC
Views: 59
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.