CVE-2026-16970

Deferred Deferred - Pending Action

Ineffective Logout in IRIS Web Application

Publication date: 2026-07-30

Last updated on: 2026-08-04

Assigner: sba-research

Description

The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-04

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-16970

EUVD

EUVD-2026-51074

Affected Vendors & Products

Vendor	Product	Version / Range
sbaresearch	dfir-iris	2.4.26

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

The vulnerability in the IRIS web application (version 2.4.26 and possibly others) involves an ineffective logout function. When a user logs out, the application only deletes the session cookie on the client side but fails to invalidate the session on the server side. This allows stolen session cookies to remain valid indefinitely, enabling attackers to misuse them for unauthorized access even after the user has logged out.

Detection Guidance

Check if session cookies remain valid after logout by inspecting network traffic or server logs for active sessions post-logout. Look for persistent session tokens in cookies or headers.

Impact Analysis

If an attacker obtains a valid session cookie, they can continue making authenticated requests to the application as if they were the legitimate user. This could lead to unauthorized access to sensitive data, actions performed on behalf of the user, or prolonged compromise of the system without the user's knowledge.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It undermines access controls and may result in non-compliance with regulations mandating proper session management and data protection measures.

Mitigation Strategies

Implement server-side session invalidation upon logout. Require re-authentication after logout. Avoid stateless tokens like JWT for session management until a patch is available.

Hi! I’m here to help you understand CVE-2026-16970. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70