Open ISES Tickets before version 3.44.2 disables TLS certificate verification in the login flow by setting the PHP cURL option to accept any certificate. This flaw allows a network attacker to present a forged HTTPS certificate and intercept, monitor, or alter data sent to or received from the remote endpoint, including API keys or credential information. The vulnerability can compromise the confidentiality and integrity of authentication traffic and may lead to credential theft or session hijacking. The weakness is a classic certificate validation failure (CWE‑295).

The affected product is Open ISES Tickets. All releases prior to 3.44.2 are impacted. The latest release no longer disables certificate verification. Users of older versions should verify their production environment is running 3.44.2 or later.

The CVSS score of 8.2 classifies the issue as High severity. While the EPSS score is not available, the lack of KEV listing does not reduce the risk; the vulnerability is exploitable by any attacker who can sit on the network path between the Ticket server and the remote endpoint used for authentication. No user interaction or authentication is required beyond the normal login flow, making remote exploitation straightforward. The combination of a high severity rating, network‑level attack vector, and the ability to capture credentials implies elevated risk for exposed environments.