Description

pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account credential including the admin account and gain full administrative control.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-15T12:17:54.943Z",
  "pubdate": "2026-09-15T12:17:54.943Z",
  "executiveSummary": "Pig versions prior to 4.1.0 contain a critical authentication bypass vulnerability located within the /register/password endpoint.\nThe vulnerability stems from improper validation of password change requests, specifically the failure to verify the authenticity of the current password.\nThis flaw allows unauthenticated or authenticated attackers to overwrite account credentials for any user, including administrative accounts, by supplying an arbitrary string in place of the current password.\nThe primary impact is complete account takeover, leading to unauthorized administrative access and total system compromise.\nThe vulnerability is remotely exploitable and does not require pre-existing knowledge of target credentials, making it a severe risk to confidentiality, integrity, and availability.\nExploitation requires the attacker to submit a crafted request to the vulnerable endpoint; no further complex conditions are necessary.",
  "technicalDetails": "The vulnerability is situated within the /register/password endpoint of the Pig application, which is responsible for processing user password update requests. The root cause is a logic error in the backend processing of incoming POST data: while the application logic expects the current password to be validated against the existing credential store before proceeding with the password overwrite, the implementation fails to utilize the return value of the verification function.\nIn the affected code path, the application attempts to verify the current password but discards the result of this check. Consequently, the conditional logic that should terminate the request upon an incorrect password match is bypassed. This behavior permits the execution of the credential update process regardless of the validity of the 'current password' field submitted in the request payload.\nTo exploit this, an attacker performs a remote attack by targeting the /register/password endpoint. The attacker constructs an HTTP request identifying a target username and an arbitrary value for the 'current password' field. The attacker then provides the 'new password' value they wish to set for the account. Because the application logic fails to validate the current password, it proceeds to update the user record in the underlying database with the attacker-supplied credentials.\nThis attack flow grants an attacker the ability to systematically overwrite the credentials of any user account registered in the system. When targeting administrative accounts, the attacker gains full administrative privileges, allowing them to perform any action the administrator is authorized to execute, including modifying system settings, accessing sensitive user data, or executing further malicious payloads.\nThe vulnerable component is identified as the password change logic within the registration module. The issue affects all versions of Pig before 4.1.0. The vulnerability is network-exposed, as the endpoint is accessible to any remote entity capable of reaching the web application. Since the vulnerability resides in the verification logic itself, no legitimate authentication is required to trigger the flaw, as the check is fundamentally broken."
}