Authentication Bypass in pig via Password Reset Endpoint

The pig application, in versions prior to 4.1.0, is affected by a critical authentication bypass vulnerability located in the /register/password endpoint. The vulnerability stems from the application discarding the results of the password verification process during the account credential update flow. Consequently, an attacker can supply an arbitrary value as the current password, bypass the validation check, and successfully overwrite the credentials for any user account, including administrative accounts. This flaw provides remote attackers with an unauthenticated path to achieve full administrative control over the affected application. Because the vulnerability allows for complete account takeover, it poses a significant risk to the integrity and confidentiality of the environment hosting the pig service.

Impact

Successful exploitation allows remote attackers to gain full administrative access to the pig application. This can lead to complete loss of account control, unauthorized access to sensitive application data, and the potential for further lateral movement if the application is integrated with other enterprise systems.

Recommendation

Prioritized actions for security teams:

• Patch the pig application to version 4.1.0 or later immediately to remediate CVE-2026-91995.
• Review web server access logs for any POST requests directed to the /register/password endpoint that correlate with suspicious administrative account changes or unexpected password resets.
• Audit existing administrative accounts for unauthorized modifications or newly created entries that align with the timeline of potential exploitation.