The login component of opensourcepos Open Source Point of Sale stores employee passwords using a weak hashing algorithm. When an attacker obtains the hashed password, the weak hash makes offline cracking feasible, allowing the attacker to compromise employee credentials and gain unauthorized access to the point‑of‑sale system. The vulnerability is exploitable remotely; however the attack requires some expertise and is considered difficult to execute.

The flaw exists in opensourcepos Open Source Point of Sale versions up to and including 3.4.2. Any installation of these versions that uses the default employee login process is potentially affected, regardless of vendor or host environment.

The CVSS score of 6.3 indicates a moderate severity, while the EPSS score is not available and the issue is not listed in the CISA KEV catalog. Remote exploitation is possible but has a high complexity and is difficult, and the very existence of the vulnerability is currently in question. Still, an attacker could target the weak hashing mechanism to acquire usable credentials if the system is not upgraded or otherwise mitigated.