Open ISES Tickets prior to version 3.44.2 disables TLS certificate verification in the rm/incs/mobile_login.inc.php file by setting CURLOPT_SSL_VERIFYPEER to false and not setting CURLOPT_SSL_VERIFYHOST when making outbound HTTPS requests during the mobile (RouteMate) login process. This improper certificate validation allows a man-in-the-middle attacker positioned on the network path to present a forged TLS certificate, enabling interception, monitoring, or modification of the HTTPS traffic, including sensitive data such as API keys or session tokens.

An attacker able to intercept network traffic between the server and remote endpoints can exploit this vulnerability to perform man-in-the-middle attacks. This can lead to exposure or tampering of sensitive data transmitted during the mobile login flow, including API keys and session-bearing information, potentially compromising user sessions or system integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider mitigating the risk by restricting network access to trusted endpoints or using network-level protections such as VPNs. Monitor vendor channels for updates and apply patches promptly once available.