CVE-2026-48241 describes a critical vulnerability in Open ISES Tickets prior to version 3.44.2 where hardcoded MySQL credentials are stored in loader.php, a public-facing database utility file. These credentials are exposed both in the public source repository and on deployed installations, allowing unauthenticated attackers with read access to obtain database connection details. The vulnerability has a CVSS 4.0 score of 9.2, indicating high impact with network attack vector and no privileges or user interaction required. The vendor has not yet provided an official fix or remediation guidance. This exposure could lead to unauthorized database access if the database is reachable from the attacker's network.

Exposure of hardcoded database credentials can allow unauthorized actors to connect to the MySQL database, potentially leading to data compromise, unauthorized data manipulation, or service disruption. The vulnerability is critical due to the ease of access and the sensitive nature of database credentials. However, exploitation requires network reachability to the database server. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict access to the loader.php file to trusted users only and ensure the database is not accessible from untrusted networks. Review and rotate database credentials if exposure is suspected. Monitor vendor channels for updates or patches addressing this issue.