CVE-2026-111329

Registro da vulnerabilidade com dados oficiais do NIST NVD, CISA KEV e FIRST EPSS.

Descrição

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.

CVSS 3.x: 9.8 CRITICAL
Publicada: 15/10/2026
Atualizada: 15/10/2026
Status NVD: Received

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fraqueza: CWE-1392

Fonte:NIST NVD· coletado 15/10/2026, 23:59

Exploração

No catálogo CISA KEV: Não
EPSS (FIRST): —

Fonte:CISA KEV· coletado 15/10/2026, 23:57

Referências

Links publicados no registro oficial

https://github.com/juggleim/im-server
https://github.com/juggleim/im-server/blob/v1.8.16/sql/imserver.sql#L988
https://github.com/juggleim/imserver-console/blob/v1.0.10/services/accountservice.go#L77-L96
https://hackmd.io/@hieuPenguinnn/juggleim-im-server-default-admin-credential
https://www.vulncheck.com/advisories/juggleim-im-server-through-1.8.16-default-admin-credentials-in-admin-console

Alguns navegadores bloqueiam sites oficiais abertos a partir da pré-visualização; copie o endereço para abrir em outra aba: https://nvd.nist.gov/vuln/detail/CVE-2026-111329