The vulnerability arises because the Open ISES Tickets application disables SSL certificate verification when performing outbound HTTPS requests. The shared helper functions set CURLOPT_SSL_VERIFYPEER to false and omit setting CURLOPT_SSL_VERIFYHOST, causing the client to accept any server certificate. As a result, an attacker who can observe traffic between the ticket server and an external HTTPS endpoint can present a forged certificate to intercept, monitor, or modify transmitted data, including API keys or session information. This weakness is classified as CWE‑295 (Improper Verification of Cryptographic Signature).

The affected software is Open ISES Tickets prior to version 3.44.2. Every installation that uses the default helper functions for outbound HTTPS communication is vulnerable, regardless of the underlying operating system.

The CVSS score of 8.2 indicates high severity. Exploitation requires that the attacker be positioned on the network path between the ticketing server and the target HTTPS endpoint; therefore the attack vector is network‑level Man‑in‑the‑Middle. The EPSS score is unavailable and the vulnerability is not listed in CISA's KEV database. An attacker could effectively capture or alter confidential data, compromising confidentiality and integrity of the system without needing authentication.