Which versions of Open ISES Tickets are affected by CVE-2026-48248?

Open ISES Tickets before version 3.44.2 contains an authentication vulnerability allowing network-based attackers to intercept and capture user login credentials.. A patch is available.

How to fix or mitigate CVE-2026-48248?

Within 24 hours: Identify all systems running Open ISES Tickets versions before 3.44.2. Within 7 days: Upgrade all affected instances to version 3.44.2 or later. Within 30 days: Audit authentication logs for suspicious login patterns and consider credential reset for administrative users.

Open ISES Tickets CVE-2026-48248

Q: What is the CVSS score of CVE-2026-48248?

CVE-2026-48248 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31330 HIGH

Improper Certificate Validation (CWE-295)

2026-05-21 VulnCheck

GHSA-qg44-r3wg-78jj

Information Disclosure PHP

8.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:36 vuln.today

Analysis Generated

May 21, 2026 - 18:36 vuln.today

Severity Changed

May 21, 2026 - 18:22 NVD

MEDIUM HIGH

CVSS changed

May 21, 2026 - 18:22 NVD

5.9 (MEDIUM) 8.2 (HIGH)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests for outbound HTTPS requests issued during the login/authentication flow. An attacker positioned on the network path between the server and the remote endpoint can present a forged certificate to intercept, monitor, or modify the request and response, including any API keys or session-bearing data in transit.

AnalysisAI

Man-in-the-middle interception of authentication traffic in Open ISES Tickets before 3.44.2 is possible because the application's login flow in incs/login.inc.php disables TLS certificate verification on outbound HTTPS requests. Network-positioned attackers can present forged certificates to capture or modify API keys and session-bearing data exchanged during login. No public exploit identified at time of analysis, though the fix is bundled into a broader critical security release that also addresses 69 XSS and 19 SQL injection issues.

Technical ContextAI

The affected component is the PHP-based Open ISES Tickets application (cpe:2.3:a:open_ises:tickets), an open-source ticketing/incident system. The root cause is CWE-295 (Improper Certificate Validation): the login include sets CURLOPT_SSL_VERIFYPEER to false and omits CURLOPT_SSL_VERIFYHOST entirely on cURL handles used for outbound HTTPS calls. Without VERIFYPEER, libcurl skips chain-of-trust validation against the CA bundle, and without VERIFYHOST it skips matching the certificate's Common Name/SAN to the requested hostname - together this means any certificate, including a self-signed or attacker-forged one, will be accepted on the TLS handshake used during the authentication flow.

RemediationAI

Vendor-released patch: upgrade to Open ISES Tickets 3.44.2 or later, available at https://github.com/openises/tickets/releases/tag/v3.44.2 - the release notes confirm SSL certificate validation is now enforced by default and bundle fixes for 88 other vulnerabilities, making the upgrade strongly recommended regardless of MITM exposure. For Docker deployments use 'docker compose pull && docker compose up -d'; for traditional installs extract the new zip over the existing tree and run the installer in Upgrade mode. If upgrading immediately is not possible, compensating controls include locally patching incs/login.inc.php to set CURLOPT_SSL_VERIFYPEER=true and CURLOPT_SSL_VERIFYHOST=2 (matches the upstream fix in commit ecfeb406), restricting the Tickets server's outbound HTTPS egress to a trusted forward proxy that performs its own certificate validation, or constraining outbound traffic to specific, pinned destinations via host firewall rules - the trade-off is that locally editing PHP will be overwritten on next upgrade and proxy-based egress controls add operational complexity but block off-path MITM regardless of application behavior.