CVE-2026-111330
High · CVSS 8.2Published 2026-10-15
CVSS
8.2
High
EPSS
—
exploit probability
Active Exploit
No
not yet listed
What is CVE-2026-111330?
JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using precomputed tables or GPU brute force.
CVSS Score Explained
CVSS 8.2 is High severity. Exploitation is likely straightforward and the impact is significant — data loss, privilege escalation, or remote code execution are common outcomes. Patch as soon as possible.
EPSS Exploitation Probability
No EPSS score yet — model needs more data on this CVE.
References & Patches
- ›https://github.com/juggleim/im-server
- ›https://github.com/juggleim/im-server/blob/v1.8.16/sql/imserver.sql#L3-L15
- ›https://github.com/juggleim/imserver-console/blob/v1.0.10/services/accountservice.go#L95
- ›https://hackmd.io/@hieuPenguinnn/juggleim-im-server-default-admin-credential
- ›https://www.vulncheck.com/advisories/juggleim-im-server-through-1.8.16-weak-password-hashing-via-unsalted-sha-1
Track vulnerabilities for your stack
Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.
Recent CVEs
- CVE-2026-8311Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-5819Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-2937Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-107316Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-107172Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2025-3778Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—