pig Authentication Bypass via Password Verification Logic Flaw

Technical Analysis

CVE-2026-91995 stems from a logic flaw where the /register/password endpoint computes a password verification check but discards the boolean or comparison result before proceeding with the credential update, effectively treating all verification attempts as successful. An attacker can send a crafted request specifying any target username along with an arbitrary 'current password' value, and the backend will process the request as if authentication succeeded, allowing the account's password to be reset to an attacker-chosen value. This grants full account takeover including admin-level access with no prior authentication or session token required, and enables lateral movement, data exfiltration, or deployment of further payloads once inside. If pig is used as a management, orchestration, or identity component within an AI agent stack (e.g., a control panel or credential store an agent framework relies on for API keys or service accounts), this bypass could allow attackers to hijack the associated admin account and pivot to steal agent credentials, tamper with agent configurations, or manipulate RAG/tool-access permissions.

Affected Systems

pig application versions prior to 4.1.0; specifically the /register/password HTTP endpoint and any deployment exposing this route to remote/unauthenticated network access

Indicators of Compromise

• POST requests to /register/password with mismatched or arbitrary current_password fields
• Unexpected password reset events for admin or privileged accounts
• Anomalous login activity following unauthorized password changes
• Requests containing username parameters for accounts other than the requester's own session (if any session context exists)

Remediation Steps

1. 1

   Upgrade to pig 4.1.0 or later

   Apply the vendor patch that correctly enforces password verification results before allowing credential updates.

2. 2

   Restrict endpoint access

   Temporarily restrict or firewall access to /register/password until the patch is applied, limiting exposure to trusted networks only.

3. 3

   Audit account activity

   Review logs for unauthorized password reset events, particularly on administrative or service accounts, since the vulnerability's disclosure window.

4. 4

   Force credential rotation

   Rotate passwords and any dependent API keys, tokens, or secrets for admin and service accounts that may have been compromised.

5. 5

   Implement monitoring and alerting

   Add detection rules for repeated or anomalous password-change requests targeting the affected endpoint.

6. 6

   Review agent integrations

   If pig is integrated with AI agent orchestration or credential management systems, audit and rotate any exposed API keys or service credentials used by agents.