Auth bypass in Pig4cloud Pig
CVE-2025-63691
In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interface (/api/admin/sys-token/page) has an improper permission verification issue, which leads to information leakage. This interface can be called by any user who has completed login authentication, and it returns the plaintext authentication Tokens of all users currently logged in to the system. As a result, ordinary users can obtain the administrator's authentication Token through this interface, thereby forging an administrator account, gaining the system's management permissions, and taking over the system.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.004 (27.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 27th percentile — 27.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
Weakness classification (CWE)
References
- github.com/pig-mesh/pig/issues/1202 (Broken Link)
- github.com/LockeTom/vulnerability/blob/main/md/pig_Information_disclosure_vulne… (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2025-63691?
- CVE-2025-63691 is a critical-severity vulnerability in Pig4cloud Pig, classified under Improper Authorization. CVSS score: 9.6/10. Published 2025-11-07.
- How severe is CVE-2025-63691?
- Critical severity. CVSS v3 base score is 9.6 out of 10.