CVE-2026-48248 | BDVDB-2026-334449 Detail

Description#

Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests issued during the login/authentication flow. An attacker positioned on the network path between the server and the remote endpoint can present a forged certificate to intercept, monitor, or modify the request and response, including any API keys or session-bearing data in transit.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-05-21Record published in the CVE List.
2. Version 22026-11-08Most recent update recorded in the CVE List.