Which versions of Open ISES Tickets are affected by CVE-2026-48249?

Open ISES Tickets versions before 3.44.2 contain a TLS certificate verification flaw in the RouteMate mobile login flow that allows network-positioned attackers to intercept login traffic and steal…. A patch is available.

How to fix or mitigate CVE-2026-48249?

Within 24 hours: Identify all systems running Open ISES Tickets versions before 3.44.2 and review network logs for evidence of TLS interception during the vulnerability period. Within 7 days: Upgrade all affected systems to Open ISES Tickets v3.44.2 and revoke API keys issued to accounts with active mobile login sessions. Within 30 days: Conduct a full audit of TLS certificate verification enforcement across all outbound HTTPS connections in the application stack.

Open ISES Tickets CVE-2026-48249

Q: What is the CVSS score of CVE-2026-48249?

CVE-2026-48249 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31329 HIGH

Improper Certificate Validation (CWE-295)

2026-05-21 VulnCheck

GHSA-x9qr-969f-24wr

Information Disclosure PHP

8.2

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

May 21, 2026 - 18:36 vuln.today

Analysis Generated

May 21, 2026 - 18:36 vuln.today

Severity Changed

May 21, 2026 - 18:22 NVD

MEDIUM HIGH

CVSS changed

May 21, 2026 - 18:22 NVD

5.9 (MEDIUM) 8.2 (HIGH)

DescriptionCVE.org

Open ISES Tickets before 3.44.2 disables TLS certificate verification in rm/incs/mobile_login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests for outbound HTTPS requests issued during the mobile (RouteMate) login flow. An attacker positioned on the network path between the server and the remote endpoint can present a forged certificate to intercept, monitor, or modify the request and response, including any API keys or session-bearing data in transit.

AnalysisAI

Missing TLS certificate verification in Open ISES Tickets before 3.44.2 allows network-positioned attackers to intercept and tamper with outbound HTTPS traffic from the mobile (RouteMate) login flow, exposing API keys and session-bearing data. The flaw stems from rm/incs/mobile_login.inc.php disabling CURLOPT_SSL_VERIFYPEER and omitting CURLOPT_SSL_VERIFYHOST. No public exploit identified at time of analysis, and the issue is one of 88 security fixes shipped in the v3.44.2 release.

Technical ContextAI

Open ISES Tickets is a PHP-based ticketing/dispatch application that uses cURL to issue outbound HTTPS requests during the mobile RouteMate login flow. The root cause is CWE-295 (Improper Certificate Validation): the affected handler explicitly sets CURLOPT_SSL_VERIFYPEER to false and never sets CURLOPT_SSL_VERIFYHOST, so cURL accepts any server-presented X.509 certificate without validating the chain of trust or the hostname binding. This nullifies the integrity and authenticity guarantees TLS is intended to provide, reducing the connection to opportunistic encryption that any on-path adversary with a forged certificate can transparently terminate. The affected product is identified by CPE cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:* across all versions prior to 3.44.2.

RemediationAI

Vendor-released patch: upgrade to Open ISES Tickets 3.44.2, which enables TLS verification by default and bundles 87 other security fixes (see release notes at https://github.com/openises/tickets/releases/tag/v3.44.2 and the source fix commit at https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff). Docker operators can run 'docker compose pull && docker compose up -d'; traditional installs should extract the new zip over the existing deployment and run the installer in Upgrade mode. If immediate patching is not feasible, restrict outbound HTTPS from the application server to only the legitimate RouteMate endpoint (egress allowlist by IP and SNI) and route that traffic over a trusted path or VPN to deny on-path attackers the ability to insert a forged certificate; the trade-off is that any change to the upstream endpoint will silently break logins. As a code-level interim fix, manually patch mobile_login.inc.php to set CURLOPT_SSL_VERIFYPEER=true and CURLOPT_SSL_VERIFYHOST=2, accepting the risk that this may diverge from vendor support expectations.