PT-2026-41671 · Unknown · Open Source Point Of Sale

Kamran Saifullah · Published 2026-05-18 · Updated 2026-05-19 · CVE-2026-8803

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions opensourcepos Open Source Point of Sale versions prior to 3.4.3

Description A flaw in the Employee Login component allows for the use of a weak hash. The issue is located in the Login() function within the app/Models/Employee.php file. This vulnerability is characterized by high complexity and difficult exploitability. According to the vendor, the legacy code remains to support upgrade paths, where default passwords seeded with the old hash function are migrated to a newer one upon login, and any password change utilizes the current hash function.

Recommendations Update to a version later than 3.4.2. As a temporary workaround, restrict access to the Login() function in the app/Models/Employee.php file to minimize the risk of exploitation.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-328

CWE-327

Related Identifiers

CVE-2026-8803

Affected Products

Open Source Point Of Sale

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-8803 · Security Note
• https://vuldb.com/vuln/364436/cti · Note
• https://twitter.com/VulmonFeeds/status/2056353592999608427 · Twitter Post
• https://t.me/CVEtracker/54131 · Telegram Post
• https://vuldb.com/submit/802561 · Note
• https://vuldb.com/vuln/364436 · Note
• https://twitter.com/CVEarity/status/2056408187943981528 · Twitter Post
• https://twitter.com/vuldb/status/2056601531320058098 · Twitter Post