CVE-2026-48248 affects Open ISES Tickets prior to version 3.44.2 by disabling TLS certificate verification in the incs/login.inc.php file during outbound HTTPS requests in the login flow. Specifically, the code sets CURLOPT_SSL_VERIFYPEER to false and does not set CURLOPT_SSL_VERIFYHOST, which disables validation of the server's TLS certificate. This flaw enables a man-in-the-middle attacker on the network path to present a forged certificate, allowing interception, monitoring, or modification of sensitive data transmitted during authentication, including API keys and session information. The vulnerability is rated high severity with a CVSS 4.0 score of 8.2. There is no vendor-provided patch or official remediation guidance at this time.

An attacker positioned between the vulnerable server and the remote endpoint can exploit the lack of TLS certificate validation to intercept or alter HTTPS traffic during the login/authentication process. This can lead to exposure of sensitive credentials, API keys, or session tokens, potentially compromising user accounts or system integrity. The vulnerability affects confidentiality and integrity of data in transit but does not require user interaction or privileges to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid deploying vulnerable versions in untrusted network environments or use network-level protections such as VPNs or TLS interception detection. Monitoring for updates from the Open ISES project is recommended to apply any forthcoming patches promptly.