CVE-2026-111330 Details
Description
JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using precomputed tables or GPU brute force.
A vulnerability exists in JuggleIM im-server versions through 1.8.16, where admin console passwords are stored as unsalted SHA-1 hashes. This weakness allows attackers with access to the accounts table, either through database access or backups, to easily crack the passwords using precomputed hash tables or GPU-based brute force methods.
To address this vulnerability, remove the default password from the database seed and replace it with a randomly generated password that is only provided to the operator once. Additionally, update the password hashing method to use a salted and adaptive algorithm, such as bcrypt or argon2id. For deployments that have already been set up, the admin password should be changed manually.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-916 | Use of Password Hash With Insufficient Computational Effort | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| JuggleIM im-server | <= 1.8.16 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |