The IRIS web application version 2.4.26 suffers from a vulnerability where its MFA validation mechanism does not implement limits or throttling to prevent brute-force attacks. This is classified under CWE-770, indicating allocation of resources without limits or throttling. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting medium severity with network attack vector, high attack complexity, no privileges or user interaction required, and high confidentiality impact but no integrity or availability impact. No patch or official remediation has been disclosed as of the publication date.

An attacker can perform brute-force attempts against the MFA validation process, potentially allowing unauthorized access to sensitive information protected by MFA. The confidentiality of the system is at risk, but integrity and availability are not impacted according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external rate limiting or throttling on MFA validation attempts as a temporary mitigation to reduce brute-force risk.