by Kastro
Paper/Archive/CVE-2026-111329

CVE-2026-111329

juggleim JuggleIM — JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console

EPSS 0.7%public exploitCVSS 9.8
critical.is priorityof 100
50
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.6.526 × 2010.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.

Affected

ProductAffectedFixed inSource
JuggleIM≤ 1.8.16–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploithackmd.io/@hieuPenguinnn/juggleim-im-server-default-admin-credentialwriteupgithub.com/juggleim/im-server/blob/v1.8.16/sql/imserver.sql#L988writeupgithub.com/juggleim/imserver-console/blob/v1.0.10/services/accountservice.go#L77-L96refgithub.com/juggleim/im-serverwriteupvulncheck.com/advisories/juggleim-im-server-through-1.8.16-default-admin-credentials-in-admin-console