# CVE-2025-63800: The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty…

Source: https://junglewise.ai/threats/cve-2025-63800-the-password-change-endpoint-in-open-source-point-of-sale-3-4-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-18  
License: CC BY 4.0 with a link back

CVE-2025-63800 · Severity: high · CVSS 7.5 · Published 2025-11-18

The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validation. When an authenticated user omits or leaves the `password` and `repeat_password` parameters empty in the password change request, the backend still returns a successful response and sets the password to an empty string. This effectively disables authentication and may allow unauthorized access to user or administrative accounts.

Technologies: [Opensourcepos Open Source Point of Sale](https://junglewise.ai/threats/technologies/open-source-point-of-sale). Vendors: [Opensourcepos](https://junglewise.ai/threats/vendors/opensourcepos).

## Quick answers

**Is CVE-2025-63800 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-63800 being exploited in the wild.

**How severe is CVE-2025-63800?** High severity, with a CVSS score of 7.5, published 18 November 2025.

**Which products and versions are affected?** Opensourcepos Open Source Point of Sale. The advisory does not name versions.

**Is there a fix for CVE-2025-63800?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-63800?** Check whether you run Opensourcepos Open Source Point of Sale. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Opensourcepos Open Source Point of Sale

## Related threats

- [OpenSourcePOS missing brute-force protection on login endpoint](https://junglewise.ai/threats/cve-2026-19895-opensourcepos-missing-brute-force-protection-on-login-endpoint)
- [opensourcepos Open Source Point of Sale path traversal in getPicThumb](https://junglewise.ai/threats/cve-2026-8802-opensourcepos-open-source-point-of-sale-path-traversal-in)
- [Open Source Point of Sale Stored XSS in Daily Sales table](https://junglewise.ai/threats/cve-2026-32712-open-source-point-of-sale-stored-xss-in-daily-sales-table)
- [Open Source Point of Sale Stored XSS in Stock Locations](https://junglewise.ai/threats/cve-2026-39380-open-source-point-of-sale-stored-xss-in-stock-locations)
- [Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter…](https://junglewise.ai/threats/cve-2025-68434-open-source-point-of-sale-opensourcepos-is-a-web-based-point-of)