A vulnerability, which was classified as problematic, has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function
Login of the file app/Models/Employee.php of the component Employee Login. This manipulation causes use of weak hash.
This vulnerability is registered as CVE-2026-8803. Remote exploitation of the attack is possible. No exploit is available.
The actual existence of this vulnerability is currently in question.
The vendor explains: “[T]he code is still there to allow the upgrade path to work. The default password is initially seeded with the old hash function, but then migrated to a newer one after login. [T]he hash version check might be cleaned up in the future. Currently it’s not actively in use as any password change will use a newer hash function.”
