CVE-2026-111329

9.8Critical

Published 15 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-1392

Impact

Remote unauthenticated attackers can take full administrative control over tenant applications and app secrets via the admin console on port 8090. All they need is network access to the port.

Root cause

The application ships with hardcoded default credentials (admin/123456) and the CheckLogin function automatically recreates the account even if it was deleted.

Affected systems

JuggleIM im-server through 1.8.16

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

No fixed version is specified; block external access to port 8090 immediately via firewall or security group while waiting for a patch.

shell

$ sudo iptables -A INPUT -p tcp --dport 8090 -j DROP

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111329