The IRIS web application (iris-web) version 2.4.26 and potentially other versions do not implement adequate throttling or limits on resource allocation during user authentication. This lack of protection enables brute-force attacks against user credentials. The vulnerability is classified under CWE-770, which concerns allocation of resources without limits or throttling. No official patch or remediation level has been published as of the data provided. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact.

An attacker can perform brute-force attacks against the authentication mechanism, potentially leading to unauthorized access to user accounts. The confidentiality of user credentials is at risk, but there is no direct impact on integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider implementing external protections such as rate limiting, account lockout policies, or web application firewalls to mitigate brute-force attempts.