Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

JuggleIM im-server lets anyone log in as admin

CVE-2026-111329 · published today
Summary

JuggleIM im-server versions up to 1.8.16 ship with a default username and password (admin/123456) that anyone can use to reach the admin console on port 8090. An attacker who discovers this can sign in as the administrator and take control of your tenant applications and their secret keys, even if the original account was removed. Change the default password immediately, create a unique admin account, and restrict access to the console to trusted networks.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
juggleim juggleim <= 1.8.16
Original advisory text
JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.3 Critical
Type
CWE-1392Use of Default Credentials
Timeline
Published15 Oct 2026
Updated15 Oct 2026
First seen15 Oct 2026
Sources
CVE-2026-111329 · NVD
CVE-2026-111329 · MITRE
Track software like this
Free during beta