News

SBA Security Advisory – DFIR-IRIS Insufficient Logout Implementation (CVE-2026-16970)

Vulnerability Overview

The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time.

• Type of Vulnerability: Insufficient Logout Implementation
• Fixed in Version: not currently available
• CVE ID: CVE-2026-16970
• CVSS Vector: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
• CVSS Base Score: 4.2 (Medium)

Recommended Countermeasure

We are not aware of a fix yet. Please contact the vendor.

Link

Full Security Advisory

Credits

Michael Koppmann (SBA Research)
Mathias Tausig (SBA Research)

The discovery of this vulnerability was made possible through support from CYSSDE and the European Union.