CVE-2026-48242 identifies a critical vulnerability in Open ISES Tickets before version 3.44.2 where hardcoded MySQL database credentials (host, username, password, database name) are present in the import_mdb.php source file. Because the source code is publicly available, any reader can extract these credentials, which may be valid for deployed instances, leading to unauthorized access to the database. The vulnerability has a CVSS 4.0 score of 9.2, indicating critical severity. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

Exposure of hardcoded database credentials can lead to unauthorized access to the MySQL database used by Open ISES Tickets. This can result in data disclosure, data manipulation, or further compromise of the affected system. The critical CVSS score reflects the high potential impact due to the confidentiality, integrity, and availability implications of unauthorized database access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid deploying affected versions or remove/replace hardcoded credentials in the source code. Restrict access to the source code repository and audit deployments for the presence of these credentials to reduce exposure.