CVE-2026-111329

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-111329

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111329.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-111329

Published

2026-10-15T21:43:33Z

Modified

2026-10-16T10:46:03Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console

Details

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-1392"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111329.json"
}

References

Affected packages

Git / github.com/juggleim/im-server

Affected ranges

Type

GIT

Repo

https://github.com/juggleim/im-server

Events

Introduced

Last Affected

a3ffdd6221ed36c57b02bec27e5d53bf158e8fb7

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "1.8.16"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v1.*

v1.8.12

v1.8.14

v1.8.16

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111329.json"