openises Tickets up to 3.44.1 WhitePages reverse-phone API Key wp1.php hard-coded credentials

Summaryinfo

A vulnerability was found in openises Tickets up to 3.44.1. It has been classified as critical. The affected element is an unknown function of the file wp1.php of the component WhitePages reverse-phone API Key Handler. This manipulation causes hard-coded credentials. This vulnerability is handled as CVE-2026-48243. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical was found in openises Tickets up to 3.44.1. Affected by this vulnerability is an unknown code block of the file wp1.php of the component WhitePages reverse-phone API Key Handler. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. The CWE definition for the vulnerability is CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. As an impact it is known to affect confidentiality. The summary by CVE is:

Open ISES Tickets before 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1.php that is committed to the public source repository. Any actor with read access to the source tree can extract the key and use it to make third-party API calls billed to or rate-limited against the original owner's WhitePages account.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-48243 since 05/21/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1110.001 for this issue.

By approaching the search of inurl:wp1.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 3.44.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch ecfeb406a016766cae81c749e14b5145a9f2dbff is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-31325). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Ticket Tracking Software

Vendor

• openises

Name

• Tickets

Version

• 3.44.0
• 3.44.1

License

• open-source

Website

• Product: https://github.com/openises/tickets/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion