---
id: CVE-2026-111329
title: JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console
summary: >-
  JuggleIM im-server through 1.8.16 ships default administrator credentials
  admin/123456 that allow unauthenticated remote attackers to access the admin
  console on port 8090. Attackers can log in as administrator, even after
  account deleti…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-1392
vendor: juggleim
product: JuggleIM
affected:
  - JuggleIM <= 1.8.16
published: '2026-10-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T21:43:33.035Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111329'
references:
  - url: >-
      https://hackmd.io/@hieuPenguinnn/juggleim-im-server-default-admin-credential
  - url: 'https://github.com/juggleim/im-server/blob/v1.8.16/sql/imserver.sql#L988'
  - url: >-
      https://github.com/juggleim/imserver-console/blob/v1.0.10/services/accountservice.go#L77-L96
  - url: 'https://github.com/juggleim/im-server'
  - url: >-
      https://www.vulncheck.com/advisories/juggleim-im-server-through-1.8.16-default-admin-credentials-in-admin-console
    label: >-
      VulnCheck Advisory: JuggleIM im-server through 1.8.16 Default Admin
      Credentials in Admin Console
tags:
  - cve.org
ingestedAt: '2026-10-15T22:48:25.453Z'
---

## Overview

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.

## Affected

- `JuggleIM <= 1.8.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.