CVE-2026-8803 Details
Description
A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/Employee.php of the component Employee Login. This manipulation causes use of weak hash. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is considered difficult. The actual existence of this vulnerability is currently in question. The vendor explains: "[T]he code is still there to allow the upgrade path to work. The default password is initially seeded with the old hash function, but then migrated to a newer one after login. [T]he hash version check might be cleaned up in the future. Currently it's not actively in use as any password change will use a newer hash function."
A vulnerability exists in opensourcepos Open Source Point of Sale versions prior to 3.4.2, specifically in the Employee Login function within the app/Models/Employee.php file. This flaw allows for the use of a weak password hash, potentially enabling remote exploitation. However, the vulnerability's actual existence is uncertain, as the vendor notes that the old hash function is still present to support the upgrade path, with default passwords initially using the old hash but migrating to a newer one after login.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 18, 2026CISA-ADP
Assessed May 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vuldb.com/submit/802561 | [email protected] | Permission Required |
| https://vuldb.com/vuln/364436 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/364436/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | [email protected] |
| CWE-328 | Use of Weak Hash | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| opensourcepos | <= 3.4.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 18, 2026 | New CVE Received | [email protected] |