CVE-2026-111329
Critical · CVSS 9.3Published 2026-10-15
CVSS
9.3
Critical
EPSS
—
exploit probability
Active Exploit
No
not yet listed
High — patch soon — High severity. Target patch within 7 days.
What is CVE-2026-111329?
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.
CVSS Score Explained
CVSS 9.3 is Critical — the highest severity tier. Attackers can likely exploit this remotely with no authentication and cause full system compromise. Patch immediately.
EPSS Exploitation Probability
No EPSS score yet — model needs more data on this CVE.
References & Patches
- ›https://github.com/juggleim/im-server
- ›https://github.com/juggleim/im-server/blob/v1.8.16/sql/imserver.sql#L988
- ›https://github.com/juggleim/imserver-console/blob/v1.0.10/services/accountservice.go#L77-L96
- ›https://hackmd.io/@hieuPenguinnn/juggleim-im-server-default-admin-credential
- ›https://www.vulncheck.com/advisories/juggleim-im-server-through-1.8.16-default-admin-credentials-in-admin-console
Track vulnerabilities for your stack
Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.
Recent CVEs
- CVE-2026-8311Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-5819Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-2937Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-107316Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-107172Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2025-3778Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—