CVE-2026-16971

The IRIS research data management platform has a critical blind spot in its multi-factor authentication implementation: the TOTP validation endpoint accepts unlimited authentication attempts without any rate limiting or brute-force protection. This is not a crypto failure—the TOTP algorithm itself is implemented correctly. The failure is architectural: the development team likely applied rate limiting to the password login endpoint but treated the MFA checkpoint as conceptually 'protected by' the password layer, leaving it exposed in the actual HTTP flow. If you're defending an IRIS deployment, your priority is confirming whether this endpoint is exposed to unauthenticated or partially-authenticated request streams. The vulnerable pattern is a stateless TOTP validation endpoint callable via AJAX or API without IP-based throttling, account lockout after N failed attempts, or any form of request metering. Attackers who have already bypassed the password layer (through credential stuffing, phishing, or insider access) can target this endpoint to brute-force the six-digit TOTP code—only 1 million combinations, trivially enumerable with modern compute. The blast radius here is significant. IRIS protects research datasets, clinical data, institutional collaborations, and often integrates with institutional SSO. Compromise of a single IRIS account isn't just a user-level problem—it can mean publication integrity compromise, lateral movement into healthcare research systems, or access to federally-funded project data. A 5.9 CVSS score badly understates this in a research platform context. Your remediation steps: first, confirm whether IRIS has published a fix and whether your version is affected—this vulnerability class was documented in CISA advisories and OWASP guidance years ago, so the pattern is known. Second, if no vendor patch exists, implement rate limiting at your WAF or reverse proxy for the MFA validation endpoint specifically—do not assume application-level rate limiting on the password endpoint extends to this path. Third, audit your authentication flow for other 'forgotten' checkpoints: backup code enumeration handlers, recovery flow validators, and secondary email/SMS verification endpoints often carry the same assumption gap. Fourth, review IRIS's integration graph—if it touches institutional SSO or downstream research systems, account takeover here is lateral movement, not just account compromise. The low EPSS score likely reflects absence of commoditized exploit tooling rather than genuine low risk. Once this pattern is automated, the exploitability question reverses entirely. Prioritize the fix based on the sensitivity of the data IRIS protects, not the CVSS number.

Reviewed through automated stages and approved by a human before publication.