Pig (< 4.1.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/pig--4.1.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 15 Sep 2026 13:40:26 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthentication Bypass in pig via Password Reset Endpointhttps://feed.craftedsignal.io/briefs/2026-09-pig-auth-bypass/Tue, 15 Sep 2026 13:40:26 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-pig-auth-bypass/An authentication bypass vulnerability in pig versions prior to 4.1.0 allows remote attackers to perform unauthorized account takeovers by exploiting improper password verification in the /register/password endpoint.The pig application, in versions prior to 4.1.0, is affected by a critical authentication bypass vulnerability located in the /register/password endpoint. The vulnerability stems from the application discarding the results of the password verification process during the account credential update flow. Consequently, an attacker can supply an arbitrary value as the current password, bypass the validation check, and successfully overwrite the credentials for any user account, including administrative accounts. This flaw provides remote attackers with an unauthenticated path to achieve full administrative control over the affected application. Because the vulnerability allows for complete account takeover, it poses a significant risk to the integrity and confidentiality of the environment hosting the pig service.

Impact

Successful exploitation allows remote attackers to gain full administrative access to the pig application. This can lead to complete loss of account control, unauthorized access to sensitive application data, and the potential for further lateral movement if the application is integrated with other enterprise systems.

Recommendation

Prioritized actions for security teams:

  • Patch the pig application to version 4.1.0 or later immediately to remediate CVE-2026-91995.
  • Review web server access logs for any POST requests directed to the /register/password endpoint that correlate with suspicious administrative account changes or unexpected password resets.
  • Audit existing administrative accounts for unauthorized modifications or newly created entries that align with the timeline of potential exploitation.
]]>criticaladvisory