CVE-2025-63691: 
NixOS vulnerability analysis and mitigation

CVE-2025-63691 is an improper authorization vulnerability in pig-mesh Pig (versions 3.8.2 and below) that allows any authenticated user to retrieve plaintext authentication tokens for all currently logged-in users, including administrators. The flaw exists in the Token Management interface (/api/admin/sys-token/page) under the System Management module, which lacks proper permission enforcement. It was published on November 7, 2025, and has a CVSS v3.1 base score of 9.6 (Critical) (Feedly, PoC Write-up).

The root cause is CWE-285 (Improper Authorization): the /api/admin/sys-token/page endpoint fails to restrict access based on user role, allowing any authenticated session to query it. The endpoint returns plaintext authentication tokens for all active sessions in the system, including those belonging to administrator accounts. An attacker with only a low-privileged authenticated account can call this API directly (e.g., via a crafted HTTP GET/POST request) without any additional preconditions beyond completing login. A detailed proof-of-concept write-up documenting the reproduction steps is publicly available (PoC Write-up).

A successful exploit allows a low-privileged authenticated user to obtain the administrator's plaintext authentication token, effectively forging an administrator identity and gaining full system management permissions. This results in high confidentiality impact (exposure of all active session tokens) and high integrity impact (ability to perform any administrative action, including modifying users, configurations, and data). The scope is marked as Changed, meaning the impact extends beyond the initially compromised user context to the entire system (Feedly).

A public proof-of-concept exploit is available on GitHub, documented by researcher LockeTom, with step-by-step reproduction instructions (PoC Write-up). The exploit requires only a valid low-privileged account and a single API call, making it trivially exploitable with low attack complexity. The EPSS score is approximately 0.051% (0.000510), indicating currently low observed exploitation probability. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog (Feedly).

1. Obtain a low-privileged account: Register or obtain credentials for any standard user account on the target Pig instance (e.g., username testuser).
2. Authenticate and retrieve session token: Log in as the low-privileged user and capture the authentication token issued upon successful login (e.g., from the login response or browser storage).
3. Call the vulnerable token management endpoint: Using the low-privileged user's token, send an authenticated HTTP request to /api/admin/sys-token/page (e.g., GET /api/admin/sys-token/page with the Authorization: Bearer <testuser_token> header).
4. Extract administrator token: Parse the API response, which returns plaintext authentication tokens for all currently logged-in users, including the administrator (admin) account token.
5. Verify administrator token: Use the extracted admin token to call /api/admin/user/info to confirm it belongs to the admin account.
6. Take over the system: Use the admin token to perform any privileged administrative actions — modifying users, accessing sensitive data, changing system configurations, or further lateral movement (PoC Write-up).

• Network: Authenticated HTTP requests to /api/admin/sys-token/page originating from non-administrative user accounts or unexpected source IPs; subsequent requests to /api/admin/user/info or other admin endpoints using tokens not associated with the originating user session.
• Logs: Application access logs showing low-privileged user accounts querying the /api/admin/sys-token/page endpoint; admin-level API calls immediately following a low-privileged user's session activity from the same or different IP address.
• Behavioral: Unusual administrative actions (user creation, configuration changes, privilege escalation) performed under the admin account from an IP address or session not associated with the legitimate administrator's login (PoC Write-up).

The primary remediation is to upgrade pig-mesh Pig to a version beyond 3.8.2, which addresses the improper permission verification on the token management endpoint (Feedly). As an interim workaround, restrict network-level access to the /api/admin/sys-token/page endpoint to administrator roles only via API gateway or reverse proxy ACLs. Additionally, audit and rotate all active authentication tokens immediately, and monitor for unauthorized token usage. Implementing additional authentication mechanisms (e.g., re-authentication for sensitive admin endpoints) is also recommended.

The vulnerability was reported via a GitHub issue on the pig-mesh/pig repository (issue #1202, since deleted) and documented in a public PoC write-up by researcher LockeTom. Red Hat tracked the CVE in their security advisory database. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified (Feedly, PoC Write-up).