Is there a patch available for CVE-2026-48245?

Yes, a patch is available for CVE-2026-48245. Update the affected software to the latest version immediately.

Open ISES Tickets CVE-2026-48245

Q: What is the CVSS score of CVE-2026-48245?

CVE-2026-48245 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31328 MEDIUM

Use of Hard-coded Credentials (CWE-798)

2026-05-21 VulnCheck

GHSA-544v-wvfr-r5pw

PHP Google Authentication Bypass

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:39 vuln.today

Analysis Generated

May 21, 2026 - 18:39 vuln.today

CVSS changed

May 21, 2026 - 18:22 NVD

5.3 (MEDIUM) 6.9 (MEDIUM)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in tables.php that is committed to the public source repository. The key can be extracted by anyone with read access to the source and used to make Google Maps Platform requests billed against the original owner's Google Cloud project.

AnalysisAI

Open ISES Tickets exposes a hardcoded Google Maps API key committed directly to its public GitHub source repository in tables.php, affecting all versions before 3.44.2. Any party with read access to the repository - effectively the entire internet - can extract the key and authenticate to Google Maps Platform as the application owner, generating API usage billed against the victim's Google Cloud project. No public exploit has been identified at time of analysis, but the SSVC framework rates this as automatable with partial technical impact, and the v3.44.2 release notes confirm the key is one of five hardcoded secrets removed in a batch of 88 security fixes.

Technical ContextAI

Open ISES Tickets is a PHP-based ticketing system (CPE: cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:*) that embeds a Google Maps Platform API key as a static string literal inside tables.php, which is tracked in the public version-controlled repository. The root cause class is CWE-798 (Use of Hard-coded Credentials), a design flaw where secrets are baked into source code rather than managed through environment variables or a secrets manager. Because Google Maps Platform uses API keys as bearer tokens to authenticate billing accounts, possession of the key is sufficient to issue authorized API requests without any further credential - the key acts as an authentication bypass against Google's billing infrastructure, which aligns with the 'Authentication Bypass' tag in the advisory metadata. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects that extraction requires no special tools, no network position, and no prior access beyond browsing a public repository.

RemediationAI

Upgrade to Open ISES Tickets v3.44.2 immediately, following the vendor's instructions: for Docker deployments run 'docker compose pull && docker compose up -d'; for traditional installs, download the v3.44.2 zip from https://github.com/openises/tickets/releases/tag/v3.44.2, extract over the existing installation, and run the installer in Upgrade mode. The underlying fix is captured in commit ecfeb406a016766cae81c749e14b5145a9f2dbff (https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff). Upgrading alone is insufficient: because the key has been present in the public repository's commit history, it must be treated as compromised regardless of whether abuse has been observed. Administrators must revoke the exposed Google Maps API key in the Google Cloud Console and generate a new key, then configure the new key outside of source code (e.g., via environment variable or server-side configuration file excluded from version control). Optionally, apply API key restrictions in Google Cloud Console (HTTP referrer or IP restrictions) to limit the blast radius of any future key exposure.