{"id":"CVE-2026-111329","published":"2026-10-15T22:19:31.063","lastModified":"2026-10-16T18:25:45.343","description":"JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-1392"],"vendors":[],"products":[],"references":[{"url":"https://github.com/juggleim/im-server","tags":[]},{"url":"https://github.com/juggleim/im-server/blob/v1.8.16/sql/imserver.sql#L988","tags":[]},{"url":"https://github.com/juggleim/imserver-console/blob/v1.0.10/services/accountservice.go#L77-L96","tags":[]},{"url":"https://hackmd.io/@hieuPenguinnn/juggleim-im-server-default-admin-credential","tags":[]},{"url":"https://www.vulncheck.com/advisories/juggleim-im-server-through-1.8.16-default-admin-credentials-in-admin-console","tags":[]},{"url":"https://hackmd.io/@hieuPenguinnn/juggleim-im-server-default-admin-credential","tags":[]}],"exploitRefs":[{"url":"https://github.com/juggleim/im-server","tags":[]},{"url":"https://github.com/juggleim/im-server/blob/v1.8.16/sql/imserver.sql#L988","tags":[]},{"url":"https://github.com/juggleim/imserver-console/blob/v1.0.10/services/accountservice.go#L77-L96","tags":[]}],"hasPoc":true,"ai":{"summary":"JuggleIM im-server contains default administrator credentials (admin/123456) that allow unauthenticated remote attackers to access the admin console on port 8090, enabling full administrative control over tenant applications and app secrets even after account deletion.","exploitability":"Extremely easy to exploit with no preconditions required; attackers can immediately log in as administrator using the default credentials without any authentication or authorization steps.","blast_radius":"High impact across all tenant applications and app secrets, allowing attackers to fully compromise the entire messaging platform and potentially access sensitive data from multiple tenants.","remediation":"Upgrade to version 1.8.17 or later to fix the default credential vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["authentication","default-credentials","remote-access"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:46:38.733Z"}}