CVE-2026-91995 in pig
Summary
by MITRE • 09/15/2026
pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account credential including the admin account and gain full administrative control.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The Apache Pig project, prior to version 4.1.0, contains a critical authentication bypass vulnerability within its /register/password endpoint that fundamentally undermines the integrity of user credential management systems. This flaw arises from improper validation logic in the server-side processing of password change requests. Specifically, when a user attempts to update their password by providing both a current valid password and a new desired password, the application fails to verify whether the provided current password matches the existing stored credentials for that account. Instead of rejecting the request if the current password is incorrect or missing, the system discards this verification step entirely and proceeds directly with updating the user's password record using only the newly submitted value. This architectural oversight effectively neutralizes one of the primary security controls designed to prevent unauthorized access to user accounts, allowing any authenticated session that can reach this endpoint to overwrite credentials without proving ownership of the existing account.
From a technical perspective, this vulnerability represents a classic case of broken authentication logic where the precondition for modifying sensitive data is not enforced. The flaw allows remote attackers to exploit the /register/password endpoint by submitting a POST request containing a target username and a new password value while omitting or providing an incorrect current password field. Because the backend does not perform a cryptographic comparison between the submitted current password and the hashed password stored in the database, the update operation succeeds regardless of whether the attacker knows the original credentials. This behavior is particularly dangerous because it enables account takeover attacks against any user on the system, including privileged administrative accounts that possess elevated permissions to manage data, configure systems, or access sensitive information. The vulnerability does not require complex exploitation techniques; a simple HTTP request with crafted parameters is sufficient to hijack an account and assume its identity within the application environment.
The operational impact of this vulnerability is severe, as it directly compromises the confidentiality and integrity of user accounts across the entire platform. An attacker who successfully exploits this flaw can gain full administrative control by targeting high-privilege accounts such as administrators or system operators. Once inside an admin account, the attacker may exfiltrate sensitive data, modify application configurations to maintain persistence, install backdoors, or disrupt service availability for legitimate users. Furthermore, because the vulnerability affects all user types equally, it also poses a significant risk to regular end-users whose personal information and activity logs could be accessed by malicious actors. The ease of exploitation means that automated scanning tools can rapidly identify vulnerable instances in public-facing deployments, leading to widespread compromise if patches are not applied promptly.
This issue aligns with CWE-287 Improper Authentication, as the system fails to adequately verify identity before granting access or performing privileged operations. It also relates to CWE-640 Weak Password Recovery Mechanism for Forgotten Password, although in this specific context, it is more accurately described as a failure in password change verification rather than recovery. In terms of offensive security frameworks, this vulnerability facilitates the ATT&CK technique T1078 Valid Accounts, where adversaries obtain legitimate credentials to access resources without needing to bypass technical controls through brute force or injection attacks. The lack of proper input validation and session context checking allows for straightforward account takeover via parameter manipulation.
To mitigate this risk, organizations running Apache Pig versions earlier than 4.1.0 must upgrade immediately to the patched version where the password verification logic has been corrected to enforce strict matching between the submitted current password and the stored credential hash before allowing any updates. For environments that cannot be upgraded instantly due to operational constraints, temporary mitigations should include implementing a Web Application Firewall rule set that monitors for anomalous patterns in /register/password requests, such as missing or empty current password fields paired with new password values. Additionally, enforcing multi-factor authentication adds an additional layer of security that can prevent attackers from leveraging stolen credentials even if they successfully hijack the account through this vulnerability. Regular auditing of access logs and implementing rate limiting on credential change endpoints can further reduce the likelihood of successful exploitation by detecting rapid or repeated failed attempts associated with automated attack tools.