The vulnerability in Open ISES Tickets prior to version 3.44.2 involves improper TLS certificate validation in the rm/incs/mobile_login.inc.php file. Specifically, the code disables SSL peer verification (CURLOPT_SSL_VERIFYPEER=false) and does not verify the SSL host (no CURLOPT_SSL_VERIFYHOST), weakening the security of HTTPS requests made during the mobile login process. This flaw enables a man-in-the-middle attacker on the network path to present a forged TLS certificate, thereby intercepting or modifying sensitive data transmitted between the client and remote endpoint.

An attacker positioned on the network path can exploit this vulnerability to intercept, monitor, or alter HTTPS requests and responses during the mobile login flow. This may lead to exposure of sensitive information such as API keys and session tokens, potentially compromising user accounts or system integrity. The vulnerability is rated high severity (CVSS 8.2) due to the potential impact on confidentiality and integrity of data in transit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider mitigating risk by restricting network access to trusted endpoints or using network-level protections such as VPNs to prevent man-in-the-middle attacks. Avoid using affected versions in untrusted network environments.