CVE-2026-48213 is a reflected cross-site scripting vulnerability affecting Open ISES Tickets prior to version 3.44.2. The issue exists because the ticket_id POST parameter is directly embedded into an HTML form input value without proper neutralization or sanitization. Authenticated attackers can exploit this by crafting a malicious request that injects JavaScript code, which executes in the context of the victim's browser when the page is rendered. This can lead to typical XSS impacts such as session hijacking or unauthorized actions performed in the victim's session. The vulnerability is rated medium severity with a CVSS 4.0 score of 5.1. No vendor advisory or patch links are currently available, and the product is not a cloud service.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of a victim's browser session when viewing the affected page. This can lead to theft of sensitive information, session hijacking, or other malicious actions performed with the victim's privileges. However, exploitation requires authentication, which limits the attack surface. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit access to trusted authenticated users only and consider additional input validation or web application firewall rules to detect and block malicious payloads targeting the ticket_id parameter. Monitor vendor channels for updates and apply patches promptly once available.