CVE-2026-91995: Pig-Mesh Pig

Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days.

pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account credential including the admin account and gain full administrative control.

Affected products

• Pig-Mesh Pig: before 4.1.0 (fixed in 4.1.0)

Published 2026-09-15. Last modified 2026-09-24.