pig (pkg:github/pig-mesh/pig) before 4.1.0 allows unverified password changes via /register/password because current-password verification results are discarded. Remote unauthenticated attackers can submit a target username with any “current password” to overwrite credentials (including admin) and gain full administrative control. Upgrade to 4.1.0+ (fix commit ce958668).