A weakness in Webkul Aureus ERP’s UserForm processing allows attackers to supply passwords that do not meet the system’s intended strength requirements. This flaw stems from an insufficient validation routine, resulting in effectively weak or predictable passwords. An attacker who can set or reset a password may easily guess, brute‑force, or otherwise compromise user accounts, leading to unauthorized access and potential escalation of privileges.

The vulnerability impacts Webkul Aureus ERP versions up to and including 1.6.0, specifically the UserForm.php file in plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php. No other versions or products are listed as affected.

The CVSS score of 6.3 indicates a moderate impact with an attacker able to exploit the weakness remotely, though the reported complexity is high and the overall exploitability is considered difficult. While the EPSS score is not available, the public nature of the exploit suggests that discovered attacks could be deployed. The issue is not currently listed in CISA’s KEV catalog.