The flaw resides in the rm/incs/mobile_login.inc.php of Open ISES Tickets, where during the mobile (RouteMate) login flow outbound HTTPS requests are issued with TLS certificate verification disabled by setting CURLOPT_SSL_VERIFYPEER to false and omitting CURLOPT_SSL_VERIFYHOST. This allows an attacker positioned on the network path between the server and the remote endpoint to present a forged certificate, intercept, monitor, or modify the request and response, including any API keys or session-bearing data in transit. The vulnerability class corresponds to CWE-295, a denial of proper TLS validation, which can lead to credential compromise and further escalation.

Vulnerable installations are those running any Open ISES Tickets release prior to version 3.44.2. No specific patch revisions are listed, but the problem exists until the latest release where TLS verification is correctly enabled.

With a CVSS score of 8.2, the vulnerability is considered high severity. The EPSS score is < 1%, and the issue is not listed in the CISA KEV catalog, indicating that no publicly known exploitation campaigns have yet been reported. The attack vector is inferred as a network-based MitM: an adversary on the path between the server and the external endpoint can supply a malicious certificate. The absence of certificate verification creates a clear avenue for interception or tampering of login traffic, making the vulnerability exploitable under realistic network conditions.