Description

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be launched remotely. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-15T14:17:07.840Z",
  "pubdate": "2026-08-15T14:17:07.840Z",
  "executiveSummary": "An improper restriction of excessive authentication attempts vulnerability has been identified in opensourcepos Open Source Point of Sale up to version 3.4.2.\nThe vulnerability resides within the Login Endpoint, specifically targeting the Login::index function located in app/Config/Filters.php.\nThis security defect allows remote threat actors to execute repeated, automated authentication attempts without proper throttling or account lockout mechanisms.\nWhile the attack requires a high level of complexity and the exploitability is currently rated as difficult, the exploit is now public, increasing operational risk.\nSuccessful exploitation could facilitate brute-force attacks against administrative or user credentials, potentially leading to unauthorized system access.\nThe project was notified early via an issue report but has not yet provided an official vendor response or patch.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient controls over authentication frequency within the Login Endpoint of the application.\nSpecifically, the Login::index function handled within app/Config/Filters.php fails to implement adequate rate limiting, request throttling, or CAPTCHA validation mechanisms to restrict excessive authentication attempts.\nThe affected component is exposed remotely over the network, allowing unauthenticated remote attackers to interact directly with the authentication interface.\nAlthough the attack requires a high level of complexity and exploitability is described as difficult, a malicious actor can script automated payloads to bypass standard interaction delays if session management or IP-based restrictions are absent.\nThe attack flow proceeds as follows: the remote attacker crafts an automated script targeting the app/Config/Filters.php routing layer mapped to the Login::index function.\nThe attacker initiates a high volume of concurrent or sequential HTTP POST requests containing credential permutations to brute-force valid user accounts.\nBecause the application lacks proper state tracking or request-rate enforcement for failed login attempts, the server processes each authentication request iteratively without imposing temporary bans, IP blocks, or exponential backoff delays.\nPost-exploitation impact includes the successful compromise of valid credentials, granting the attacker unauthorized access to the Point of Sale system, sensitive transaction data, inventory controls, and administrative privileges depending on the targeted account.\nVersions up to 3.4.2 of opensourcepos Open Source Point of Sale are definitively affected by this improper restriction mechanism."
}