Open ISES Tickets before version 3.44.2 disables TLS certificate verification in incs/login.inc.php by setting the PHP cURL option CURLOPT_SSL_VERIFYPEER to false and not setting CURLOPT_SSL_VERIFYHOST when issuing outbound HTTPS requests during authentication. This flaw lets an attacker positioned on the network path between the Ticket server and the remote endpoint present a forged certificate, intercepting, monitoring, or modifying the traffic, including API keys or session‑bearing data. The vulnerability compromises confidentiality and integrity of authentication data and can lead to credential theft or session hijacking. The weakness is a certificate validation failure (CWE‑295).

The affected product is Open ISES Tickets. All releases prior to 3.44.2 are impacted. The latest release no longer disables certificate verification. Users of older versions should verify their production environment is running 3.44.2 or later.

The CVSS score of 8.2 classifies the issue as High severity. The EPSS score of 0.00028 (under 1%) indicates a very low probability of exploitation in the wild, but the vulnerability is still technically exploitable by any attacker who can sit on the network path between the Ticket server and the remote authentication endpoint. No user interaction or authentication beyond the normal login flow is required, allowing remote exploitation through a man‑in‑the‑middle attack. The combination of a high severity rating, network‑level attack vector, and the ability to capture credentials or session data results in a significant risk for exposed environments, even though the EPSS suggests low exploitation likelihood.