A discarded password-verification result in the pig framework's /register/password endpoint allows unauthenticated remote attackers to reset any account's credentials, including admin, and seize full administrative control.
What Is It
CVE-2026-91995 is an authentication bypass in pig (pig-mesh) versions before 4.1.0. The /register/password endpoint performs a password verification check but discards the result, meaning any value submitted as the current password is accepted. A remote attacker can supply a target username along with an arbitrary, incorrect current password and overwrite that account's credential. VulnCheck, the assigning CNA, classifies the flaw as CWE-620 (Unverified Password Change); the record was published 2026-09-15.
Why It Matters
The CNA-supplied metrics give the flaw a CVSS 3.1 base score of 9.1 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, and a CVSS 4.0 score of 9.3 (CRITICAL). It is reachable over the network, requires low attack complexity, needs no privileges, and requires no user interaction. Confidentiality and integrity impacts are both HIGH. Because the admin account can be taken over directly, a single unauthenticated request is enough to escalate to full administrative control of an affected deployment.
What's Vulnerable
- Vendor/product: pig-mesh / pig (
pkg:github/pig-mesh/pig) - Affected versions: all versions before 4.1.0 (semver,
< 4.1.0); all other versions are listed as unaffected - Affected code paths:
SysRegisterController.java(lines 21–53) andSysUserServiceImpl.java(lines 650–669) inpig-upms/pig-upms-biz, as of tag v4.0.0
No CPE entries have been assigned for this record yet.
Patch Status
Upgrade to pig 4.1.0 or later. The fix is available in commit ce958668f399110b97b3f1fcc5f517ff9bcfd535, tracked in upstream issue #1249. NVD currently lists the record as Received status, so the CNA-supplied CWE and CVSS data above have not yet been reviewed or enriched by NVD analysts; expect the classification and scores to be confirmed or adjusted once full analysis completes.