CVE-2026-91995

pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account credential including the admin account and gain full administrative control.

  • Published Sep 15, 2026
  • CVSS 9.3 critical
  • 0.9% chance of exploitation in the next 30 days (EPSS)
  • A fix is available

Affected software

CVE-2026-91995 at the National Vulnerability Database