Open Source POS CVE-2026-8803

Q: What is the CVSS score of CVE-2026-8803?

CVE-2026-8803 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30768 MEDIUM

Use of Weak Hash (CWE-328)

2026-05-18 VulDB

GHSA-2gcj-979q-prrq

Information Disclosure PHP

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 18, 2026 - 12:30 vuln.today

Severity Changed

May 18, 2026 - 12:22 NVD

LOW MEDIUM

CVSS changed

May 18, 2026 - 12:22 NVD

3.7 (LOW) 6.3 (MEDIUM)

DescriptionCVE.org

A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/Employee.php of the component Employee Login. This manipulation causes use of weak hash. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is considered difficult. The actual existence of this vulnerability is currently in question. The vendor explains: "[T]he code is still there to allow the upgrade path to work. The default password is initially seeded with the old hash function, but then migrated to a newer one after login. [T]he hash version check might be cleaned up in the future. Currently it's not actively in use as any password change will use a newer hash function."

AnalysisAI

Weak password hashing in opensourcepos Open Source Point of Sale through version 3.4.2 exposes a legacy code path in the Employee Login component (app/Models/Employee.php) that retains an older, cryptographically weak hash function. The vendor has disputed the severity of this issue, clarifying that the weak hash function persists solely to support an upgrade migration path - default-seeded passwords use the legacy hash but are migrated to a stronger algorithm upon first login, meaning actively managed accounts on updated installations face reduced practical exposure. No public exploit code has been identified at time of analysis, and the vulnerability's real-world impact is currently in question pending independent verification.

Technical ContextAI

The affected component is the Login function within app/Models/Employee.php of the opensourcepos application, a PHP-based point-of-sale system (CPE: cpe:2.3:a:opensourcepos:open_source_point_of_sale:*:*:*:*:*:*:*:*). The root cause is classified as CWE-328 (Use of Weak Hash), meaning the application historically relied on a cryptographically weak hashing algorithm (such as MD5 or SHA-1) to store or verify employee passwords. The vendor's explanation reveals a dual-hash architecture: the legacy hash remains in the codebase to allow accounts seeded with the old algorithm to authenticate and subsequently be migrated to a modern hash on first successful login. This 'hash version check' pattern is a known migration anti-pattern that leaves a temporary exposure window for accounts that have never been logged into post-upgrade.

RemediationAI

No vendor-released patch with a confirmed fix version has been identified at time of analysis. The vendor has acknowledged the legacy hash code path exists and indicated it 'might be cleaned up in the future,' but has not committed to a specific remediation release. As an immediate compensating control, administrators should ensure all employee accounts have logged in and completed the automatic hash migration to the newer algorithm - accounts that have never authenticated post-upgrade retain the weaker hash. Forcing a password reset for all accounts (especially default-seeded ones) will trigger re-hashing with the modern algorithm and eliminate the vulnerable code path for those accounts. Additionally, restricting network access to the Point of Sale login endpoint via firewall rules or VPN requirement raises the effective attack complexity further. Monitor VulDB advisory https://vuldb.com/vuln/364436 and the opensourcepos repository for a formal patch addressing removal of the legacy hash check.