Open ISES Tickets Vulnerability in Authentication Flow Disables TLS Verification

CVE-2026-48248

What is CVE-2026-48248?

A vulnerability in Open ISES Tickets before version 3.44.2 disables TLS certificate verification during the login/authentication process. This flaw arises from the setting of CURLOPT_SSL_VERIFYPEER to false in incs/login.inc.php, which can allow an attacker monitoring the network to present a forged certificate. By exploiting this weakness, an attacker can intercept, monitor, or modify sensitive data transmitted over HTTPS, including session identifiers and API keys, posing significant risks to user credentials and data integrity.

References