Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck

CVE-2026-91995pig before 4.1.0 Unverified Password Change via /register/password

Critical 9.1

In plain English

A critical-severity security flaw in pig from pig-mesh. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.9%top 40.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account credential including the admin account and gain full administrative control.

Affected products (as reported)

Vendor	Product	Versions
pig-mesh	pig	0 – before 4.1.0

Weakness: CWE-620 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Researcher write-up third-party-advisory, exploit
GitHub Issue #1249 (content redacted by the maintainer) issue-tracking
Fix commit ce958668 patch
SysUserServiceImpl.java at v4.0.0 technical-description
SysRegisterController.java at v4.0.0 technical-description
https://github.com/pig-mesh/pig product
VulnCheck Advisory: pig before 4.1.0 Unverified Password Change via /register/password third-party-advisory