PT-2025-47338 · Unknown · Open Source Point Of Sale

Omkaryepre · Published 2025-11-18 · Updated 2025-11-19 · CVE-2025-63800

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open Source Point of Sale version 3.4.1

Description The password change functionality has a flaw where a user can set an empty password due to a lack of server-side validation. Omitting or providing empty values for the password and repeat password parameters in a password change request results in a successful response and an empty password being set. This bypasses authentication and potentially allows unauthorized access to user or administrative accounts. The vulnerable API endpoint is the password change endpoint.

Recommendations Apply a fix that enforces server-side validation to prevent setting an empty password.

Exploit

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2025-63800

Affected Products

Open Source Point Of Sale

References · 7

• 🔥 https://github.com/omkaryepre/vulnerability-research/tree/main/CVE-2025-63800 · Exploit
• https://osv.dev/vulnerability/CVE-2025-63800 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63800 · Security Note
• https://github.com/opensourcepos/opensourcepos · Note
• https://twitter.com/CVEnew/status/1991066237389132215 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1990946167522214140 · Twitter Post
• https://opensourcepos.org · Note