JuggleIM Server Flaw Exposes Admin Console via Default Credentials
A critical vulnerability in JuggleIM im-server allows unauthenticated attackers to access the admin panel using default login details.
Key points
- CVE-2026-111329 carries a CVSS score of 9.3, rated as critical severity.
- The flaw affects JuggleIM im-server versions through 1.8.16.
- Attackers can regain administrator access even after the account is deleted.
JuggleIM im-server contains a critical security flaw that exposes its administrative console to unauthenticated remote attackers. The vulnerability, identified as CVE-2026-111329, stems from the inclusion of default administrator credentials that remain active by default in the software.
According to the National Vulnerability Database record, the issue affects all versions of JuggleIM im-server up to and including version 1.8.16. The flaw allows anyone with network access to the server to log in using the preset username and password combination without needing prior authentication or valid user tokens.
Context and Background
The vulnerability is classified with a CVSS score of 9.3, which indicates a critical level of severity. This high score reflects the ease with which an attacker can exploit the flaw and the significant impact it has on the confidentiality, integrity, and availability of the system.
The underlying weakness is categorized under CWE-1392, which relates to the use of hard-coded credentials. By shipping with a static default password, the software creates a persistent entry point for malicious actors who scan for known weak configurations on exposed ports.
Who is Affected
Administrators running JuggleIM im-server versions 1.8.16 or earlier are directly affected by this issue. The default credentials allow access to the admin console listening on port 8090. Once inside, attackers can take full control of tenant applications and manage application secrets.
A particularly dangerous aspect of this flaw is the behavior of the CheckLogin function. According to the NVD description, an attacker can log in as the administrator even after the account has been deleted. The system automatically recreates the account upon login attempts, making it difficult for administrators to block access through standard user management procedures.
What should you do?
Organizations using JuggleIM im-server should immediately verify if their instances are running vulnerable versions. If the software is exposed to the internet, the risk of unauthorized access is immediate. Administrators should restrict access to port 8090 using network firewalls or access control lists to limit exposure to trusted networks only.
What to do and how to stay safe: JuggleIM
- Check if your JuggleIM im-server version is 1.8.16 or lower and review access logs for unauthorized logins.
- Configure firewalls to block external access to port 8090 unless specifically required for administrative tasks.
- Change the default administrator credentials immediately if the vendor has provided a method to override them.
- Monitor for any unexpected changes to tenant applications or app secrets that may indicate compromise.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-111329?
The CVSS score for CVE-2026-111329 is 9.3, which is rated as critical severity.
Which versions of JuggleIM im-server are affected?
All versions of JuggleIM im-server through 1.8.16 are affected by this vulnerability.
Can attackers access the admin console if the account is deleted?
Yes, the CheckLogin function recreates the account, allowing attackers to log in even after deletion.
