CVE-2026-91995

Name of the Vulnerable Software and Affected Versions pig versions prior to 4.1.0

Description An authentication bypass exists in the '/register/password' endpoint. The system discards the results of the current password verification, which allows any value to be accepted as the current password. Remote attackers can provide a username and an incorrect current password to overwrite account credentials, including those of the administrator, leading to full administrative control and account takeover.

Recommendations Update pig to version 4.1.0.