# CVE-2026-48248: Open ISES Tickets improper TLS certificate validation in login component

Source: https://junglewise.ai/threats/cve-2026-48248-open-ises-tickets-improper-tls-certificate-validation-in-login  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-21. Updated: 2026-05-21  
License: CC BY 4.0 with a link back

CVE-2026-48248 · Severity: medium · CVSS 5.9 · Published 2026-05-21

Open ISES Tickets, an open-source ticketing system, fails to properly verify security certificates when communicating with other servers during the login process. This flaw allows a sophisticated attacker positioned on the network to intercept sensitive information, such as login credentials or API keys, by impersonating a trusted server. Organizations using this software should upgrade to version 3.44.2 or later to ensure their data remains encrypted and secure during transit.

Technologies: [Open ISES Tickets](https://junglewise.ai/threats/technologies/tickets). Vendors: [Open ISES](https://junglewise.ai/threats/vendors/open-ises).

## Quick answers

**Is CVE-2026-48248 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48248 being exploited in the wild.

**How severe is CVE-2026-48248?** Medium severity, with a CVSS score of 5.9, published 21 May 2026.

**Which products and versions are affected?** Open ISES Tickets before 3.44.2.

**Is there a fix for CVE-2026-48248?** A patch was published on 2026-04-01: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48248 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48248?** Check whether you run Open ISES Tickets at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Open ISES Tickets before version 3.44.2 contains an improper certificate validation vulnerability (CWE-295) within 'incs/login.inc.php'. The application explicitly disables TLS verification by setting 'CURLOPT_SSL_VERIFYPEER' to false and failing to set 'CURLOPT_SSL_VERIFYHOST' during outbound HTTPS requests in the authentication flow. A man-in-the-middle (MITM) attacker positioned between the server and the remote endpoint can present a forged certificate to intercept, monitor, or modify traffic. This can lead to the exposure of API keys and session-bearing data. The issue is resolved in version 3.44.2.

## Affected products

- Open ISES Tickets before 3.44.2

## Timeline

- 2026-04-01: patched: Fix committed to repository
- 2026-04-02: advisory: Release v3.44.2 published
- 2026-05-21: disclosed: CVE-2026-48248 published

## References

- [https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff](https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff)
- [https://github.com/openises/tickets/releases/tag/v3.44.2](https://github.com/openises/tickets/releases/tag/v3.44.2)
- [https://www.vulncheck.com/advisories/open-ises-tickets-disabled-tls-certificate-verification-in-incs-login-inc-php](https://www.vulncheck.com/advisories/open-ises-tickets-disabled-tls-certificate-verification-in-incs-login-inc-php)

## Related threats

- [Open ISES Tickets improper TLS certificate validation in mobile login](https://junglewise.ai/threats/cve-2026-48249-open-ises-tickets-improper-tls-certificate-validation-in-mobile)
- [Open ISES Tickets improper TLS certificate verification in functions.inc.php](https://junglewise.ai/threats/cve-2026-48247-open-ises-tickets-improper-tls-certificate-verification-in)
- [Open ISES Tickets improper TLS certificate validation in ajax/reports.php](https://junglewise.ai/threats/cve-2026-48246-open-ises-tickets-improper-tls-certificate-validation-in-ajax)
- [Open ISES Tickets hardcoded Google Maps API key in tables.php](https://junglewise.ai/threats/cve-2026-48245-open-ises-tickets-hardcoded-google-maps-api-key-in-tables-php)
- [Open ISES Tickets hardcoded Google Maps API key in settings.inc.php](https://junglewise.ai/threats/cve-2026-48244-open-ises-tickets-hardcoded-google-maps-api-key-in-settings-inc)