CVE-2026-91995

Katalog CVE

CVSS 9.1 · Critical EPSS 0,88%

Kerentanan Unverified Password Change. Skor CVSS 3.1 9.1 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account credential including the admin account and gain full administrative control.

Rincian

Terbit di NVD

15 September 2026

Terakhir diubah

24 September 2026

Status NVD

Deferred

CVSS 3.1

9.1 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-620: Unverified Password Change

EPSS (30 hari)

0,88% peluang dieksploitasi; lebih tinggi dari 57,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/geo-chen/oss/blob/main/pig.md
• https://github.com/pig-mesh/pig
• https://github.com/pig-mesh/pig/blob/v4.0.0/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/contro...
• https://github.com/pig-mesh/pig/blob/v4.0.0/pig-upms/pig-upms-biz/src/main/java/com/pig4cloud/pig/admin/servic...
• https://github.com/pig-mesh/pig/commit/ce958668f399110b97b3f1fcc5f517ff9bcfd535
• https://github.com/pig-mesh/pig/issues/1249
• https://www.vulncheck.com/advisories/pig-before-4.1.0-unverified-password-change-via-register-password