Is there a patch available for CVE-2026-48244?

Yes, a patch is available for CVE-2026-48244. Update the affected software to the latest version immediately.

Open ISES Tickets CVE-2026-48244

Q: What is the CVSS score of CVE-2026-48244?

CVE-2026-48244 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31323 MEDIUM

Use of Hard-coded Credentials (CWE-798)

2026-05-21 VulnCheck

GHSA-gf9f-hqc6-ch9x

PHP Google Authentication Bypass

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:45 vuln.today

Analysis Generated

May 21, 2026 - 18:45 vuln.today

CVSS changed

May 21, 2026 - 18:22 NVD

5.3 (MEDIUM) 6.9 (MEDIUM)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in settings.inc.php that is committed to the public source repository. The key can be extracted by anyone with read access to the source and used to make Google Maps Platform requests billed against the original owner's Google Cloud project.

AnalysisAI

Hardcoded Google Maps API key exposure in Open ISES Tickets before v3.44.2 enables any party with read access to the public GitHub repository to extract a valid API credential from settings.inc.php and issue arbitrary Google Maps Platform requests billed against the victim organization's Google Cloud project. All versions from the initial release up to (but not including) 3.44.2 are affected per CPE cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:*. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but exploitation requires only the ability to read a publicly hosted source file - effectively zero technical barrier for any motivated actor.

Technical ContextAI

Open ISES Tickets is a PHP-based help-desk and ticketing application. The affected file settings.inc.php was committed to the public GitHub repository with a live Google Maps Platform API key embedded directly in source code - a textbook CWE-798 (Use of Hard-coded Credentials) pattern. Google Maps Platform API keys are project-scoped bearer tokens: possession of the key is sufficient to authenticate requests to the Maps JavaScript API, Geocoding API, and related services, with all costs charged to the associated Google Cloud billing account. Because the repository is public, the key is exposed to the entire internet without requiring any access to the running application or its database. The v3.44.2 release notes confirm this was one of five hardcoded secrets (API keys and database passwords) removed in that release, indicating the credential exposure pattern was systemic rather than isolated.

RemediationAI

Upgrade to Open ISES Tickets v3.44.2 immediately; this release removes the hardcoded Google Maps API key along with four additional hardcoded secrets. The patch commit is available at https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff. Critically, upgrading the application alone is insufficient: because the exposed key was committed to a public repository and may have been observed by automated credential-scanning tools at any point in the repository's history, the Google Maps API key must be revoked and regenerated in Google Cloud Console regardless of when this issue is discovered. Review Google Cloud billing history for anomalous Maps Platform charges to determine if the key was already abused. For Docker deployments, run 'docker compose pull && docker compose up -d'. For traditional installations, download the v3.44.2 zip, extract over the existing installation, and run the installer in Upgrade mode. Note that v3.44.2 also patches 69 XSS vulnerabilities, 19 SQL injection vulnerabilities, and multiple SSL certificate validation issues - all of which represent additional attack surface on any pre-3.44.2 deployment.