Vulnerability details

CVE-2026-111329

juggleim JuggleIM

JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console

CVSS 4.0

9.3Critical

Official description

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.

CVSS scores

Score	Version	Source	Vector
9.3Critical	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
9.8Critical	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
juggleim	JuggleIM	v ≤ 1.8.16	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/juggleim/im-server/blob/v1.8.16/sql/imserver.sql#L988 technical-description
https://github.com/juggleim/imserver-console/blob/v1.0.10/services/accountservice.go#L77-L96 technical-description
https://github.com/juggleim/im-server product
https://www.vulncheck.com/advisories/juggleim-im-server-through-1.8.16-default-admin-credentials-in-admin-console third-party-advisory
https://hackmd.io/@hieuPenguinnn/juggleim-im-server-default-admin-credential third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-10-16
Last updated: 2026-10-16
State: Published
Assigner (CNA): VulnCheck
Kolun priority: 27 · Low

Exploit prediction (EPSS)

0.68%

Probability of exploitation in 30 days

52.9%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-1392
Use of Default Credentials