CVE-2026-111329: falha crítica em JuggleIM
JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.7%
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
juggleim · JuggleIMCVEs relacionadas — JuggleIM
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/juggleim/im-serverhttps://github.com/juggleim/im-server/blob/v1.8.16/sql/imserver.sql#L988https://github.com/juggleim/imserver-console/blob/v1.0.10/services/accountservice.go#L77-L96https://hackmd.io/@hieuPenguinnn/juggleim-im-server-default-admin-credentialhttps://www.vulncheck.com/advisories/juggleim-im-server-through-1.8.16-default-admin-credentials-in-admin-console