A critical authentication bypass vulnerability in Open Source Point of Sale 3.4.1 allows unauthorized access by enabling users to set account passwords to an empty string.

The vulnerability exists in the password change endpoint, which lacks server-side validation for password parameters. An attacker can trigger this flaw by submitting a request with empty password fields, allowing them to effectively neutralize authentication for any account.

The ability to clear account passwords poses a severe risk to organizational data integrity and confidentiality. By bypassing authentication, unauthorized actors could gain full access to administrative or user accounts, leading to potential data theft, manipulation of transaction records, or total system compromise. Given the CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent unauthorized system access.

Immediate Action: Monitor official project repositories for a security patch addressing this validation error and apply it immediately upon release.

Proactive Monitoring: Review web server and application access logs for unusual password change requests or patterns of authentication bypass attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or inspect requests to the password change endpoint that contain empty or malformed password parameters.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up referenced by the CVE record.

The vulnerability represents a significant risk to the security of the Open Source Point of Sale platform. Administrators must treat this as a priority and implement the necessary configuration changes or patches as soon as they become available. Until a formal fix is deployed, restrict access to the application to trusted internal networks only to minimize the exposure of the vulnerable endpoint.