The IRIS web application implements a logout function that does not correctly invalidate session cookies, allowing an attacker who captures a session token to retain unauthorized access indefinitely. This flaw is an example of insecure session management, classified as CWE‑613, and permits session hijacking without credential compromise.

The vulnerability affects the dfir-iris:iris-web product, documented in version 2.4.26 and likely impacting other releases of the IRIS web application. No other vendors or product families are listed as affected.

The overall severity is low, reflected in a CVSS score of 4.2, and the EPSS score is below 1 %, indicating a very low probability of exploitation. The issue is not listed in the CISA KEV catalog. The likely attack vector is inferred to be any scenario where an attacker obtains a valid session cookie—through phishing, network interception when HTTPS is not enforced, or malware on the user’s machine. Once a cookie is compromised, it can be reused indefinitely, allowing continued unauthorized access until server‑side session data is manually invalidated. The risk mainly affects confidentiality and integrity of user data, and could have a significant impact if privileged sessions are hijacked.