Critical flaw in open-source 'pig' admin platform lets anyone bypass password checks

A newly published vulnerability in the open-source “pig” admin platform has been rated critical, with a CVSS score of 9.1. The headline claim is stark: an attacker doesn’t need to know your current password to change it. Whether that translates into a real-world problem for you depends heavily on whether you’ve ever heard of pig in the first place.

What the bug actually does

According to the NVD entry for CVE-2026-91995, versions of pig before 4.1.0 mishandle password changes at the /register/password endpoint. The code checks whether the submitted “current password” matches the real one - and then discards the result of that check. In practice, that means the verification step is theatre: any string can be entered as the existing password, and the system will still let it through to set a new one.

That’s about as basic an authentication-bypass as they come. There’s no clever chaining of bugs or exotic exploit chain required - just knowing the endpoint exists and that the check is broken.

So who is actually at risk

Pig is described on its GitHub page as an RBAC (role-based access control) system built on Spring Cloud, Spring Boot and OAuth2 - essentially a framework organisations use to build internal admin panels and manage who can do what inside a piece of software. It’s a genuinely popular open-source project, sitting at roughly 6.7k stars and 1.1k forks at the time of writing, which suggests it’s been forked and deployed by a fair number of developers building their own systems on top of it.

That popularity is exactly why this matters more than the average obscure CVE - but it also comes with caveats worth being honest about. The NVD listing doesn’t say whether this is being actively exploited in the wild, and there’s no public evidence of attacks at the time of writing. Nor is there a reliable count of how many live, internet-facing deployments are actually running an unpatched version - GitHub stars measure developer interest, not production usage. If you’ve never installed or deployed pig yourself, directly or as a dependency in an internal tool, this bug has no bearing on you at all.

For the developers and organisations who have deployed it, the risk is straightforward: anyone who can reach that password-change endpoint could potentially take over an account without knowing its password, which in an RBAC system could mean escalating into administrative access.

What to do about it

The fix, per the advisory, is version 4.1.0 or later. If you or your organisation run pig - or a fork built on it - the sensible move is to check your version, update promptly, and review authentication logs for unusual password-reset activity in the meantime. There’s no indication yet of a public proof-of-concept exploit doing the rounds, but a bug this simple to describe tends not to stay quiet for long.

The takeaway

This is a real, well-documented flaw with a concrete fix - not hype. But its reach is bounded by pig’s install base, which is real but modest and largely developer-facing. If you’re not running it, there’s nothing to do here beyond noting, again, that “verify before it verifies you” remains good advice for any password-change form.