CVE-2026-111329

Summary

JuggleIM im-server contains default administrator credentials (admin/123456) that allow unauthenticated remote attackers to access the admin console on port 8090, enabling full administrative control over tenant applications and app secrets even after account deletion.

Exploitability

Extremely easy to exploit with no preconditions required; attackers can immediately log in as administrator using the default credentials without any authentication or authorization steps.

Blast radius

High impact across all tenant applications and app secrets, allowing attackers to fully compromise the entire messaging platform and potentially access sensitive data from multiple tenants.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.8.17 or later to fix the default credential vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.