CVE-2026-91995: Pig Authentication Bypass Vulnerability

CVE-2026-91995 Overview

CVE-2026-91995 is an authentication bypass vulnerability in the Pig microservice framework (pig-mesh/pig) affecting all versions prior to 4.1.0. The flaw resides in the /register/password endpoint of the pig-upms module, where the result of the current password verification check is discarded. Remote unauthenticated attackers can submit any username with an arbitrary current password value and overwrite the target account's credentials. Successful exploitation grants full control over any account, including the built-in admin user, resulting in complete administrative takeover of the application [CWE-620: Unverified Password Change].

Critical Impact
Unauthenticated remote attackers can overwrite the password of any account, including administrative users, without knowing the existing credential.

Affected Products

pig-mesh/pig versions prior to 4.1.0
pig-upms module (SysRegisterController and SysUserServiceImpl)
Deployments running Pig v4.0.0 and earlier 4.x releases

Discovery Timeline

2026-09-15 - CVE-2026-91995 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-91995

Vulnerability Analysis

The vulnerability exists in the password reset workflow exposed through the /register/password endpoint handled by SysRegisterController. The controller delegates password reset requests to SysUserServiceImpl.resetUserPassword(RegisterUserDTO userDto), which is expected to validate that the supplied current password matches the stored credential before persisting a new one.

In vulnerable releases, the service calls checkPassword(username, password) but only inspects the R response wrapper's outer status via isOk(). Because checkPassword returns a successful R wrapper that carries a Boolean payload indicating the actual verification result, the outer isOk() value is true even when the password does not match. The negative verification result is silently discarded and the reset proceeds.

Root Cause

The root cause is a logic flaw in result handling: the code inspects the transport wrapper rather than the boolean verification payload. This maps to CWE-620 (Unverified Password Change), because the password change operation completes without a valid check of the caller's knowledge of the existing password.

Attack Vector

An attacker sends an HTTP request to /register/password containing the target username, an arbitrary password (treated as the current password), and a newpassword1 value. The server accepts the request, ignores the failed verification, and updates the stored credential. The attacker then authenticates as the target user, including the admin account, obtaining full administrative privileges over the application.

java

// Security patch in SysUserServiceImpl.java
// Source: https://github.com/pig-mesh/pig/commit/ce958668f399110b97b3f1fcc5f517ff9bcfd535
	 */
	@Override
	@CacheEvict(value = CacheConstants.USER_DETAILS, key = "#userDto.username")
-	public R resetUserPassword(RegisterUserDTO userDto) {
+	public R<Boolean> resetUserPassword(RegisterUserDTO userDto) {
 		// 校验密码
-		R checkedPassword = checkPassword(userDto.getUsername(), userDto.getPassword());
-		if (!checkedPassword.isOk()) {
+		R<Boolean> checkedPassword = checkPassword(userDto.getUsername(), userDto.getPassword());
+		if (!Boolean.TRUE.equals(checkedPassword.getData())) {
 			return checkedPassword;
 		}

The patch changes the return type to R<Boolean> and gates the reset on Boolean.TRUE.equals(checkedPassword.getData()), ensuring the actual verification result controls the flow. See the GitHub commit ce95866 and the VulnCheck Advisory for Pig for additional context.

Detection Methods for CVE-2026-91995

Indicators of Compromise

HTTP POST requests to /register/password from external or unexpected source addresses.
Password change events for privileged accounts such as admin without a matching prior authenticated session.
Sudden authentication success from new source IPs for accounts that were previously idle.
Audit log entries for resetUserPassword calls that lack a preceding successful login for the same account.

Detection Strategies

Instrument the SysRegisterController endpoint to log every reset attempt with source IP, target username, and outcome.
Alert on any reset request targeting built-in or administrative usernames (admin, service accounts).
Correlate /register/password requests with authentication events; flag resets that are not preceded by a valid session for that user.
Baseline the normal call rate for the endpoint and alert on spikes or scripted patterns.

Monitoring Recommendations

Forward Pig application logs and reverse-proxy access logs to a centralized SIEM or data lake for retention and correlation.
Enable audit logging on the user store so that credential mutations produce discrete, queryable events.
Monitor the admin account and other high-privilege identities for password changes, permission edits, and new session creation.
Track outbound behavior from hosts running Pig for signs of post-compromise activity such as new scheduled jobs or configuration changes.

How to Mitigate CVE-2026-91995

Immediate Actions Required

Upgrade pig-mesh/pig to version 4.1.0 or later, which contains the fix in commit ce95866.
Restrict network exposure of the /register/password endpoint using WAF or reverse-proxy rules until patching is complete.
Rotate credentials for the admin account and other privileged users, and force password resets for all accounts.
Review authentication and audit logs for unauthorized calls to /register/password since deployment.

Patch Information

The fix is delivered in Pig 4.1.0 via GitHub commit ce95866, which corrects resetUserPassword in SysUserServiceImpl to evaluate the boolean payload returned by checkPassword instead of only the response wrapper status. Additional context is available in the GitHub Pig Project Repository, GitHub Issue #1249, and the VulnCheck Advisory for Pig.

Workarounds

Block or require authentication in front of the /register/password route at the API gateway or reverse proxy.
Disable the self-service password reset feature until the upgrade to 4.1.0 is deployed.
Apply the upstream patch as an internal hotfix by overriding SysUserServiceImpl.resetUserPassword to enforce Boolean.TRUE.equals(checkedPassword.getData()).

bash

# Example nginx rule to block external access to the vulnerable endpoint
location = /register/password {
    allow 10.0.0.0/8;      # internal management network only
    deny  all;
    proxy_pass http://pig-upms-backend;
}