pig-mesh Pig CVE-2026-91995

Requires network reachability to the pig application's /register/password endpoint (the SysRegisterController register-password route), which is exposed for password self-service; no valid current password and no authentication are needed because the verification result is discarded. The only real limiting factors are that the target instance must run pig before 4.1.0 and the endpoint must be reachable by the attacker; no user interaction, non-default configuration, or prior credentials are required. An attacker who knows or guesses a username (e.g. the default 'admin') can overwrite that account's password.

This is a genuine high-priority issue, and the multiple signals largely agree. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H) describes a remote, low-complexity, unauthenticated flaw, and the description plus the commit diff corroborate that: checkPassword() returns its real result in the R.data boolean, but resetUserPassword() tested checkedPassword.isOk() (which is true even for a wrong password) instead of the data value, so the verification result was discarded entirely - a textbook CWE-620 Unverified Password Change. A public exploit exists (geo-chen/oss writeup) and the root cause is confirmed by the fix commit, so exploitability is not speculative. There is no CISA KEV listing and no EPSS score in the input, so there is no evidence of active mass exploitation yet - the status is 'publicly available exploit code exists,' which is distinct from in-the-wild use. The one metric worth scrutinizing is impact scope: the vendor scored VA:N (no availability impact), but because the primitive lets an attacker overwrite the admin account password, it yields full admin takeover, which realistically implies confidentiality, integrity AND availability compromise (the legitimate admin is locked out). Overall this is a real, easily weaponized authentication bypass in an internet-facing registration endpoint, not a high-CVSS-but-low-risk paper cut.

A remote unauthenticated attacker sends a POST to the /register/password endpoint supplying the target username (e.g. 'admin'), an arbitrary/incorrect 'current password,' and a new password. Because the password-verification result is discarded, the server accepts the request and overwrites the admin credential, letting the attacker log in with the password they just set and take full administrative control. A public proof-of-concept/writeup for this exact flow is available.