CVE-2026-91995 — pig before 4.1.0 Unverified Password Change via /register/password
pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the …
Published: 2026-09-15 · CVSS: 9.3 · CVSS 4.0
pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account credential including the admin account and gain full administrative control.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7