The flaw resides in the mobile login module of Open ISES Tickets, where outbound HTTPS requests are sent with TLS certificate verification disabled by setting CURLOPT_SSL_VERIFYPEER to false. This allows an attacker to present a forged certificate and intercept or modify requests, potentially exposing API keys, session tokens, or other sensitive data in transit. The vulnerability class corresponds to CWE-295, a denial of proper TLS validation, which can lead to credential compromise and further escalation.

Vulnerable installations are those running any Open ISES Tickets release prior to version 3.44.2. No specific patch revisions are listed, but the problem exists until the latest release where TLS verification is correctly enabled.

With a CVSS score of 8.2, the vulnerability is considered high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, indicating that no publicly known exploitation campaigns have yet been reported. The attack vector is inferred as a network-based MitM: an adversary on the path between the server and the external endpoint can supply a malicious certificate. The absence of certificate verification creates a clear avenue for interception or tampering of login traffic, making the vulnerability exploitable under realistic network conditions.