Which versions of Open ISES Tickets are affected by CVE-2026-48242?

Open ISES Tickets versions prior to 3.44.2 expose hardcoded MySQL database credentials in publicly accessible source code, allowing attackers to obtain valid authentication parameters for deployed…. A patch is available.

How to fix or mitigate CVE-2026-48242?

Within 24 hours: identify all Open ISES Tickets deployments, confirm versions, and immediately rotate MySQL database credentials from defaults on any instance prior to 3.44.2. Within 7 days: deploy patch to version 3.44.2 or later across all affected systems. Within 30 days: verify patch deployment completion and review database access logs for unauthorized connection attempts.

Open ISES Tickets CVE-2026-48242

Q: What is the CVSS score of CVE-2026-48242?

CVE-2026-48242 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31324 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-05-21 VulnCheck

GHSA-5hxh-6mg6-f5mh

PHP Authentication Bypass

9.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:30 vuln.today

Analysis Generated

May 21, 2026 - 18:30 vuln.today

Severity Changed

May 21, 2026 - 18:22 NVD

HIGH CRITICAL

CVSS changed

May 21, 2026 - 18:22 NVD

8.1 (HIGH) 9.2 (CRITICAL)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, password, database name) in import_mdb.php. The credentials are embedded in source code committed to the public repository, allowing any reader of the source to obtain valid configuration values that may match deployed installations.

AnalysisAI

Credential exposure in Open ISES Tickets versions prior to 3.44.2 allows remote attackers to obtain valid MySQL database connection parameters (host, username, password, database name) hardcoded in import_mdb.php and committed to the public source repository. Any attacker who can read the public GitHub source can extract these credentials and attempt to authenticate against deployed installations that retained the default values, with no public exploit identified at time of analysis.

Technical ContextAI

Open ISES Tickets is a PHP-based ticketing application (CPE cpe:2.3:a:open_ises:tickets) that uses MySQL/MariaDB as its backing datastore. The import_mdb.php helper script contained literal database connection values (DSN, user, password, DB name) embedded in the script body rather than being read from a runtime configuration file outside the webroot or environment. This is a textbook CWE-798 (Use of Hard-coded Credentials) instance: because the file ships in the public openises/tickets repository, the secrets are effectively published, and any deployment that did not change the defaults (or that mirrored the documented defaults) shares the same known credentials. The v3.44.2 release notes confirm five hardcoded secrets including database passwords were removed, alongside a broader hardening pass (88 fixes covering XSS, SQLi, SSL verification, and file permissions).

RemediationAI

Vendor-released patch: Open ISES Tickets 3.44.2, available at https://github.com/openises/tickets/releases/tag/v3.44.2 (commit ecfeb406a016766cae81c749e14b5145a9f2dbff) - upgrade traditional installs by extracting the new release over the existing tree and running the installer in Upgrade mode, or 'docker compose pull && docker compose up -d' for containerized deployments. Because credentials may already be known to attackers, the upgrade alone is insufficient: rotate the MySQL account password used by the application, rename or drop any account whose username matches the hardcoded value, and audit MySQL general/audit logs for prior logins from unexpected hosts. If immediate upgrade is impossible, compensating controls include binding MySQL to 127.0.0.1 or a private interface and firewalling port 3306 from untrusted networks (trade-off: breaks remote DB administration), and deleting or chmod-0600'ing import_mdb.php on disk (trade-off: disables the .mdb import feature). Review the v3.44.2 release notes for the other 87 fixes (XSS, SQLi, SSL verification) that should be addressed in the same maintenance window.