The IRIS web application version 2.4.26 has a vulnerability where its MFA validation mechanism lacks adequate throttling or resource allocation limits, enabling potential brute-force attacks. This is categorized as CWE-770, indicating that the application does not properly limit resource consumption during authentication attempts. The CVSS 3.1 score is 5.9 (medium), with network attack vector, high attack complexity, no privileges or user interaction required, and high confidentiality impact but no integrity or availability impact. There is no vendor advisory or patch available at this time.

An attacker could perform brute-force attempts against the MFA validation process, potentially compromising user accounts by bypassing multi-factor authentication protections. The confidentiality of user accounts is at risk, but integrity and availability are not impacted. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing external rate limiting or monitoring mechanisms to detect and block brute-force attempts against MFA endpoints.