CVE-2026-48229 is a reflected cross-site scripting vulnerability in Open ISES Tickets prior to version 3.44.2. The issue exists in routes_i.php where the ticket_id GET parameter is directly embedded into HTML form hidden input value attributes without proper neutralization of input. Authenticated attackers can craft malicious requests containing JavaScript payloads that execute in the victim's browser when the response is rendered, potentially leading to unauthorized script execution.

Successful exploitation allows an authenticated attacker to execute arbitrary JavaScript in the context of the victim's browser session within the Open ISES Tickets application. This can lead to session hijacking, unauthorized actions, or other client-side attacks depending on the payload. The vulnerability requires user interaction to trigger the malicious script execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 3.44.2, upgrading to version 3.44.2 or later is recommended once an official fix is available. In the meantime, restrict access to trusted users and monitor for suspicious activity involving the ticket_id parameter.