Is there a patch available for CVE-2026-48243?

Yes, a patch is available for CVE-2026-48243. Update the affected software to the latest version immediately.

Open ISES Tickets CVE-2026-48243

Q: What is the CVSS score of CVE-2026-48243?

CVE-2026-48243 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31325 MEDIUM

Use of Hard-coded Credentials (CWE-798)

2026-05-21 VulnCheck

GHSA-ff8w-m7v9-pp77

PHP Authentication Bypass

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:45 vuln.today

Analysis Generated

May 21, 2026 - 18:45 vuln.today

CVSS changed

May 21, 2026 - 18:22 NVD

5.3 (MEDIUM) 6.9 (MEDIUM)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1.php that is committed to the public source repository. Any actor with read access to the source tree can extract the key and use it to make third-party API calls billed to or rate-limited against the original owner's WhitePages account.

AnalysisAI

Open ISES Tickets before v3.44.2 exposes a hardcoded WhitePages reverse-phone API key committed directly into the public source file wp1.php, making it trivially accessible to any actor who can read the repository. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects that no authentication or special conditions are required - extraction is as simple as reading a publicly hosted source file. Impact is bounded to third-party API abuse: an attacker can use the stolen key to make WhitePages lookups billed to or rate-capped against the legitimate owner's account. No public exploit identified at time of analysis, and this CVE is not listed in CISA KEV, though the passive nature of the exposure means any observer of the repository may already possess the key.

Technical ContextAI

CWE-798 (Use of Hard-coded Credentials) describes the root cause: a third-party service credential - specifically a WhitePages reverse-phone lookup API key - was embedded as a literal string in wp1.php and committed into the open-source repository on GitHub, where it persists across all historical commits prior to v3.44.2. The affected product is confirmed via CPE cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:* as the Open ISES Tickets PHP application. The v3.44.2 vendor release notes explicitly confirm this was one of five hardcoded secrets removed in that release, alongside API keys and database passwords, indicating the credential storage pattern was systemic rather than isolated. The PHP tag is consistent with the source language; the credential lives in a PHP file that presumably invokes the WhitePages API at runtime, with the key directly substituted into API calls rather than loaded from environment configuration or a secrets manager.

RemediationAI

Upgrade to Open ISES Tickets v3.44.2 immediately; this release removes the hardcoded WhitePages API key along with four other hardcoded secrets, per the vendor release at https://github.com/openises/tickets/releases/tag/v3.44.2 and fix commit https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff. Critically, upgrading the application alone is insufficient - the exposed key must be revoked and rotated in the WhitePages account dashboard, because it remains readable in all historical commits on the public repository and any actor may already have captured it; rotation eliminates the window of ongoing abuse. Docker deployments upgrade via 'docker compose pull && docker compose up -d'; traditional deployments should download the v3.44.2 zip, extract it over the existing installation, and run the installer in Upgrade mode. As a compensating control prior to upgrade, operators should immediately rotate the WhitePages API key and monitor the associated account for anomalous API call volume or unexpected billing activity - this is the only actionable mitigation while patching is in progress, as restricting network access to the application does not prevent an attacker who has already read the repository from using the key.