CVE-2026-91995

pig, an open-source Spring Cloud microservice/admin platform, contains an authentication bypass in versions before 4.1.0 affecting the /register/password endpoint. The code computes the result of verifying the user's current password but then discards it, so any value is accepted as the current password. A remote, unauthenticated attacker can submit a target username (including the built-in admin account) with an arbitrary current password and a new password, overwriting the account credential and gaining full administrative control of the platform. Any self-hosted deployment of pig prior to 4.1.0 that exposes the /register/password endpoint is affected. The flaw is rated critical (CVSS 4.0: 9.3), but there is no known public proof-of-concept, it is not on the CISA KEV list, and no exploitation has been observed in the wild.

What to do: Upgrade to pig 4.1.0 or later, where the current-password verification result on /register/password is enforced. If immediate upgrade is not possible, block or restrict access to the /register/password endpoint (e.g., via gateway routing rules, WAF, or reverse-proxy ACLs) so only trusted users can reach it. Rotate credentials for privileged accounts such as admin and review logs for unexpected password-change or login activity on that endpoint.