CVE-2026-8803
Weak Hash Usage in OpenSourcePOS Employee Login
Publication date: 2026-05-18
Last updated on: 2026-05-18
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| opensourcepos | opensourcepos | to 3.4.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-327 | The product uses a broken or risky cryptographic algorithm or protocol. |
| CWE-328 | The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a flaw in the Open Source Point of Sale (opensourcepos) software up to version 3.4.2, specifically in the Employee Login function within the file app/Models/Employee.php. The issue involves the use of a weak hash function for passwords, which could potentially be exploited remotely. However, the attack is considered to have high complexity and is difficult to exploit. Additionally, the vendor notes that the weak hash code remains only to support upgrade paths and that passwords are migrated to a stronger hash after login. The weak hash is not actively used once a password is changed.
How can this vulnerability impact me? :
The impact of this vulnerability is related to the potential use of weak password hashing, which could allow an attacker to compromise employee login credentials if they manage to exploit the flaw. However, the exploitability is difficult and the attack complexity is high, reducing the likelihood of successful exploitation. Since the weak hash is only used temporarily during upgrade and replaced after login or password change, the risk is somewhat mitigated.