The vulnerability is an open redirect flaw in Iris Web that allows an attacker to craft URLs directing users to malicious sites. An attacker can trigger the redirect without user authentication by sending a specially crafted link, potentially facilitating phishing or drive‑by download attacks. The weakness is a low‑to‑moderate impact, but it can be used to degrade user trust and enable further exploits once a user follows the redirect.

This issue affects Iris Web by dfir-iris on all versions earlier than 2.4.28. Versions 2.4.28 and later contain a fix that removes the vulnerable redirect mechanism, so those releases are not affected.

The CVSS score of 4.7 indicates a moderate severity, and the EPSS score is not available, which means we lack data on current exploitation probability. The vulnerability is not listed in CISA KEV, suggesting no widespread, active exploitation has been reported yet. The likely attack vector is remote, relying on a victim clicking a crafted URL, and no privileged access or system compromise is required to exploit the flaw.