| Title | OpenSourcePOS <=3.4.2 Improper Restriction of Excessive Authentication Attempts |
|---|
| Description | OpenSourcePOS authenticates users through the Login::index() controller action, which applies a single custom validation rule (login_check) to the submitted credentials. The application implements no protection against repeated failed authentication attempts: there is no failed-attempt counter, no temporary or permanent account lockout, and no per-IP or per-account rate limiting anywhere in the login path. An attacker can therefore submit an unlimited number of username/password combinations at machine speed.
The only optional mitigation is Google reCAPTCHA, which is disabled by default (the setting gcaptcha_enable is absent from the shipped default configuration and must be enabled manually in the database). In a default deployment the login endpoint has neither CAPTCHA nor rate limiting, and /login is additionally excluded from CSRF protection (app/Config/Filters.php: 'csrf' => ['except' => 'login|migrate']), so credential-guessing requests need no token.
Even when an administrator enables reCAPTCHA, the validation logic in OSPOSRules::login_check() verifies the password before the CAPTCHA. When the password is wrong, the function returns immediately and the CAPTCHA branch is never reached. Consequently:
- Wrong-password attempts never consume or require a valid CAPTCHA token, so the CAPTCHA does not throttle guessing.
- The server returns invalid_username_and_password for a wrong password but invalid_gcaptcha once the password is correct (and a valid token is absent). This observable response discrepancy is a credential-validity oracle: an attacker can determine the correct password without solving the CAPTCHA, by watching which error is returned.
The net effect is that an attacker can enumerate valid credentials offline. With CAPTCHA disabled (default), a correct guess additionally grants an authenticated session directly (HTTP 302 redirect to /home). |
|---|
| Source | ⚠️ https://github.com/opensourcepos/opensourcepos/issues/4583 |
|---|
| User | ZAST.AI (UID 87884) |
|---|
| Submission | 06/26/2026 10:24 (2 months ago) |
|---|
| Moderation | 08/14/2026 20:52 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 390085 [opensourcepos Open Source Point of Sale up to 3.4.2 Login Endpoint app/Config/Filters.php Login::index excessive authentication] |
|---|
| Points | 20 |
|---|