CVE-2026-111329
JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console
- State
- Published
- Severity
- 9.3 Critical
- Published
- Oct 15, 2026
- Updated
- Oct 16, 2026
- Reserved
- Oct 15, 2026
Description
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-1392 Use of Default Credentials
Affected Products
| Product | Versions |
|---|---|
JuggleIMjuggleim |
|
References
- https://hackmd.io/@hieuPenguinnn/juggleim-im-server-default-admin-credentialthird-party-advisory
- https://github.com/juggleim/im-server/blob/v1.8.16/sql/imserver.sql#L988technical-description
- https://github.com/juggleim/imserver-console/blob/v1.0.10/services/accountservice.go#L77-L96technical-description
- https://github.com/juggleim/im-serverproduct
- VulnCheck Advisory: JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Consolethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.