cve.nowby Sazabi
← All vulnerabilities
CVE-2026-111329

JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console

Published
Last modified
Status
published
Known exploitation
Not listed in CISA KEV
Public exploit
None on Exploit-DB
CISA SSVC
  • Exploitation: poc
  • Automatable: yes
  • Technical impact: total
?

Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).

SSVC documentation

Summary

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.

Affected versions

  • juggleim JuggleIM

    through 1.8.16

References 5

hackmd.io

GitHub · juggleim/im-server

GitHub · juggleim/imserver-console

vulncheck.com