CVE-2026-111329

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.

An attacker can gain full administrative control over the system, including managing applications and secrets. The vulnerability is easy to exploit if port 8090 is accessible.

Immediately change the default administrator credentials and restrict access to port 8090. Update the software to a version that does not contain default credentials.