Is CVE-2026-19895 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19895 being exploited in the wild.

How severe is CVE-2026-19895?

Low severity, with a CVSS score of 3.7, published 15 August 2026.

Which products and versions are affected?

Opensourcepos Open Source Point of Sale up to 3.4.2.

Is there a fix for CVE-2026-19895?

A patch was published on 2026-07-12: Fix committed in fork purnadika/opensourcepos at 851fc32 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-19895 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-19895?

Check whether you run Opensourcepos Open Source Point of Sale at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19895: OpenSourcePOS missing brute-force protection on login endpoint

CVE-2026-19895 · Severity: low · CVSS 3.7 · Published 2026-08-15

OpenSourcePOS is a point-of-sale system used in retail and hospitality to manage sales, inventory, and employee access. The login endpoint lacks rate limiting and account lockout mechanisms, allowing attackers to conduct unlimited credential-guessing attacks against employee accounts. When reCAPTCHA is enabled (not default), the CAPTCHA validation occurs after password verification, creating a security flaw where incorrect passwords never trigger CAPTCHA protection and error messages leak whether a username exists—enabling attackers to enumerate valid credentials without solving any challenge.

Technologies: Opensourcepos Open Source Point of Sale. Vendors: Opensourcepos.

Quick answers

Is CVE-2026-19895 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19895 being exploited in the wild.
How severe is CVE-2026-19895?: Low severity, with a CVSS score of 3.7, published 15 August 2026.
Which products and versions are affected?: Opensourcepos Open Source Point of Sale up to 3.4.2.
Is there a fix for CVE-2026-19895?: A patch was published on 2026-07-12: Fix committed in fork purnadika/opensourcepos at 851fc32 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19895 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-19895?: Check whether you run Opensourcepos Open Source Point of Sale at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts). The Login::index() controller in app/Controllers/Login.php applies only a single custom validation rule (login_check) to submitted credentials with no failed-attempt counter, temporary/permanent account lockout, or per-IP rate limiting. The /login endpoint is excluded from CSRF protection by default (app/Config/Filters.php), allowing unauthenticated credential-guessing POST requests. Google reCAPTCHA is the only optional mitigation but is disabled by default. When reCAPTCHA is enabled, the password is verified before CAPTCHA validation occurs (app/Models/Employee.php::login()), so incorrect passwords never consume a CAPTCHA token. Additionally, distinct error responses ('invalid_username_and_password' vs 'invalid_gcaptcha') create an oracle allowing attackers to determine the correct password by observing which error is returned. Patches have been committed to fix these issues.

Affected products

opensourcepos Open Source Point of Sale up to 3.4.2

Timeline

2026-08-15: disclosed
2026-07-12: patched: Fix committed in fork purnadika/opensourcepos at 851fc32

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.