CVE-2026-111329 is a critical default-credential flaw in JuggleIM im-server through version 1.8.16. It lets unauthenticated remote attackers log into the admin console as administrator and take control of tenant applications and app secrets.
What Is It
JuggleIM im-server ships with default administrator credentials of admin/123456. An unauthenticated remote attacker can use them to reach the admin console on port 8090 and log in as administrator.
Deleting the default account does not fix the problem. According to the NVD description, the CheckLogin function recreates the account, so the credentials keep working afterward. VulnCheck, the CNA, classifies the weakness as CWE-1392 (Use of Default Credentials).
Why It Matters
- CVSS 3.1: 9.8 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL
Exploitation happens over the network, needs no privileges or user interaction, and has low attack complexity. An attacker who logs in can control tenant applications and app secrets, so the impact goes beyond the server to every tenant it hosts.
Because the account recreates itself, deleting the user is not a reliable fix. Any instance with port 8090 reachable should be treated as exposed until it is confirmed otherwise.
At the time of writing, the supplied data contains no CISA KEV entry for this CVE. KEV does not confirm active exploitation in the wild. However, the default credentials are publicly documented in the project's SQL schema, and a public third-party write-up exists.
What's Vulnerable
- Vendor: juggleim
- Product: JuggleIM im-server (
pkg:github/juggleim/im-server) - Affected versions: all versions through 1.8.16
- Exposed service: admin console on port 8090
The references also point to the related imserver-console component (v1.0.10, accountservice.go) as the code behind the login and account-recreation logic.
Patch Status
The supplied NVD record does not identify a fixed version, and NVD lists the record as "Received" with no further analysis yet. There is no CISA KEV entry, so no federal remediation deadline or required action applies.
Until the vendor ships a fix, owners of JuggleIM deployments should:
- Check the vendor repository and the VulnCheck advisory for patch updates.
- Restrict network access to the admin console on port 8090.
- Treat app secrets on exposed instances as possibly compromised.