CVE-2026-16971
Deferred Deferred - Pending Action

MFA Brute-Force Vulnerability in IRIS Web Application

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: sba-research

Description
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-08-19
AI Q&A
2026-07-30
EPSS Evaluated
2026-08-18
NVD
CVE-2026-16971
EUVD
EUVD-2026-51072

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-16971 is a vulnerability in the DFIR-IRIS web application version 2.4.26 and possibly others. It involves missing brute-force protection for Multi-Factor Authentication (MFA) validation. Attackers can bypass MFA by rapidly sending all possible one-time password (OTP) combinations without triggering rate-limiting or account lockouts.

Detection Guidance

Monitor HTTP requests to the /auth/mfa-verify endpoint for repeated failed OTP attempts without rate-limiting or account lockouts. Check for HTTP 200 responses for incorrect OTPs, which indicate the vulnerability is present.

Impact Analysis

This vulnerability allows attackers to bypass MFA by brute-forcing 6-digit OTP codes, which have only 1 million possible combinations. Successful exploitation could grant unauthorized access to sensitive data or systems protected by MFA in the DFIR-IRIS application.

Compliance Impact

This vulnerability weakens authentication security, potentially violating compliance requirements for strong access controls in standards like GDPR and HIPAA. Organizations using affected DFIR-IRIS versions may fail to meet regulatory obligations for protecting sensitive data.

Mitigation Strategies

Implement rate-limiting on the /auth/mfa-verify endpoint to block excessive requests per IP, account, or session. Configure HTTP 429 responses for too many requests. Disable or restrict access to the endpoint if no fix is available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16971. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart