The vulnerability arises from a hard‑coded Google Maps API key embedded in Open ISES Tickets settings.inc.php. Because the source repository is publicly accessible, any user can read the file and extract the key. This key can then be used to send Google Maps Platform requests, causing charges to accrue on the original project’s Google Cloud account. The weakness is a credential exposure (CWE‑798) and represents an information‑leak and financial risk rather than code execution.

Open ISES Tickets versions earlier than 3.44.2 are affected. The exposed key resides in settings.inc.php across the source tree for all releases before the 3.44.2 update, removing the hard‑coded key from the repository.

The CVSS score of 6.9 indicates a high severity flaw. With no EPSS value available and the vulnerability not listed in CISA KEV, the likelihood of broad exploitation is moderate, but the barrier to use is low: anyone with repository read access can obtain the key. The attack vector is primarily through source code availability, and once the key is extracted, an attacker can generate arbitrary Maps requests, leading to unwanted billing.