pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account credential including the admin account and gain full administrative control.

CVE-2026-91995 affects the pig framework before version 4.1.0, disclosing a critical authentication bypass vulnerability in the /register/password endpoint. The flaw causes password verification results to be discarded, meaning any value submitted as the current password is accepted without validation. Remote unauthenticated attackers can exploit this to overwrite credentials for any account, including the administrator account. This grants full administrative control over the affected system. The vulnerability is tracked in the pig-mesh/pig GitHub repository and was fixed in version 4.1.0 via commit ce958668. Proof-of-concept details and code references are publicly available, raising the exploitation risk significantly. Organizations using pig before 4.1.0 should upgrade immediately to mitigate the risk.