CVE-2026-111329 Details

A vulnerability exists in JuggleIM im-server versions through 1.8.16, where default administrator credentials (admin/123456) are hard-coded and allow unauthenticated remote access to the admin console on port 8090. This console access enables control over tenant applications and app secrets. The default password is stored as an unsalted SHA1 hash, making it easily recoverable. Even after deleting the admin account, the credential can be reused as the 'CheckLogin' function recreates the account.

To address this vulnerability, remove the default password from the database seed and replace it with a randomly generated password that must be changed upon first login. Additionally, store passwords using a salted hash algorithm such as bcrypt or argon2id, and implement measures to prevent unauthorized access to the admin console.