CVE-2026-35016

Insufficient state checks allow bypassing two-factor authentication (2FA) controls.

Open ISES Tickets before 3.44.2 disables TLS certificate verification in rm/incs/mobile_login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests during the mobile (RouteMate) login flow. An attacker on the network path can present a forged certificate to intercept, monitor, or modify the request and response, including API keys or session-bearing data.

Open ISES Tickets before version 3.44.2 disables TLS certificate verification in incs/login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false. An attacker on the network path can present a forged certificate to intercept authentication data.

Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/functions.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing general-purpose outbound HTTPS requests via shared helper functions. An attacker on the network path can present a forged certificate to intercept, monitor, or modify the request and response, including API keys or session-bearing data.

Open ISES Tickets before 3.44.2 disables TLS certificate verification in ajax/reports.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTTPS requests for Google Maps Directions API lookups during incident report generation. An attacker on the network path can present a forged certificate to intercept, monitor, or modify the request and response, including API keys or session-bearing data.

Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in tables.php that is committed to the public source repository. The key can be extracted by anyone with read access to the source and used to make Google Maps Platform requests billed against the original owner's Google Cloud project.

Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in settings.inc.php that is committed to the public source repository. The key can be extracted by anyone with read access to the source and used to make Google Maps Platform requests billed against the original owner's Google Cloud project.

Open ISES Tickets before version 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1.php that is committed to the public source repository. Any actor with read access to the source tree can extract the key and use it to make third-party API calls billed to or rate-limited against the original owner's WhitePages account.

In Open ISES Tickets before 3.44.2, hardcoded MySQL database credentials (host, username, password, database name) are present in import_mdb.php. These credentials are publicly available in the source repository.

Open ISES Tickets before version 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source repository. Any actor with access to the public source tree (or an unauthenticated attacker with read access to the file on a deployed installation) can read the username, password, and database name and use them to connect to the database if it is reachable from their network.