CVE-2026-8803 opensourcepos Open Source Point of Sale Employee Login Employee.php login weak hash
Weak hashing in employee login allows potential security bypass, though vendor states it is legacy code for upgrades.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-8803?
CVE-2026-8803 is a medium-severity vulnerability in opensourcepos Open Source Point of Sale, published on 18 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/Employee.php of the component Employee Login. This manipulation causes use of weak hash. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is considered difficult. The actual existence of this vulnerability is currently in question. The vendor explains: "[T]he code is still there to allow the upgrade path to work. The default password is initially seeded with the old hash function, but then migrated to a newer one after login. [T]he hash version check might be cleaned up in the future. Currently it's not actively in use as any password change will use a newer hash function."
Which versions are affected by CVE-2026-8803?
How do I fix CVE-2026-8803?
No fix has been published for CVE-2026-8803 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-8803 being exploited?
There is no known exploitation of CVE-2026-8803 in the wild and no public exploit code.
Sources
Also known as GHSA-2gcj-979q-prrq.