Threats tagged 'ghsa-q9j2-x62q-rv7w'

Open Source Point of Sale version 3.4.1 contains a vulnerability in its password change endpoint that allows authenticated users to set their account password to an empty string. This occurs because the server does not validate the password fields properly, accepting empty values and returning a successful response. Setting an empty password effectively disables authentication for that account, potentially allowing unauthorized access to user or administrative accounts.