Vulnerability Description
In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interface (/api/admin/sys-token/page) has an improper permission verification issue, which leads to information leakage. This interface can be called by any user who has completed login authentication, and it returns the plaintext authentication Tokens of all users currently logged in to the system. As a result, ordinary users can obtain the administrator's authentication Token through this interface, thereby forging an administrator account, gaining the system's management permissions, and taking over the system.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pig4Cloud | Pig | <= 3.8.2 |
Related Weaknesses (CWE)
References
- https://github.com/LockeTom/vulnerability/blob/main/md/pig_Information_disclosurExploitThird Party Advisory
- https://github.com/pig-mesh/pig/issues/1202Broken Link
FAQ
What is CVE-2025-63691?
CVE-2025-63691 is a vulnerability with a CVSS score of 9.6 (CRITICAL). In pig-mesh In Pig version 3.8.2 and below, within the Token Management function under the System Management module, the token query interface (/api/admin/sys-token/page) has an improper permission ve...
How severe is CVE-2025-63691?
CVE-2025-63691 has been rated CRITICAL with a CVSS base score of 9.6/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-63691?
Check the references section above for vendor advisories and patch information. Affected products include: Pig4Cloud Pig.