| Title | Webkul Aureuserp v1.6.0 Weak Password Requirements |
|---|
| Description | AureusERP v1.6.0 is affected by a weak password policy in the user creation functionality, where newly created accounts are protected only by a minimum password length requirement of eight characters. The application does not enforce additional password-strength requirements such as mixed uppercase and lowercase characters, numbers, or special characters. This allows administrators to create accounts using highly predictable passwords like 12345678 or other commonly used credentials. The validation is implemented in plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php, where the password field applies only a min:8 rule. As a result, passwords that meet the minimum length but are trivial to guess can be successfully assigned to user accounts and subsequently used for authentication. If an attacker can identify a valid account username or email address, they may be able to perform credential-guessing or dictionary attacks against the account, potentially resulting in unauthorized access and access to the data and functionality available to the compromised user.
Researcher - 1
Name: Karan Parelkar
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/KaranParelkar
LinkedIn: https://www.linkedin.com/in/karan-parelkar-6a370125b/
Researcher - 2
Name: Devansh Sanghvi
Independent Security Researcher
Email: [email protected]
GitHub: https://github.com/Devansh10845
LinkedIn: https://www.linkedin.com/in/devansh-sanghvi-16570325b/ |
|---|
| Source | ⚠️ https://github.com/KaranParelkar/Auresus_vulnerability/blob/main/Weak%20Password%20Policy/Readme.md |
|---|
| User | Devansh33 (UID 101178) |
|---|
| Submission | 09/11/2026 15:29 (1 month ago) |
|---|
| Moderation | 10/19/2026 11:28 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422296 [Webkul Aureus ERP up to 1.6.0 UserForm.php password weak password] |
|---|
| Points | 20 |
|---|