JuggleIM im-server: Hard-coded default admin credentials in admin console
Summary
JuggleIM im-server through version 1.8.16 ships with default administrator credentials (admin/123456) for its admin console on port 8090. An unauthenticated remote attacker who can reach the console can log in as administrator and control tenant applications and their app secrets. According to the description, the account is recreated on login even after deletion, so removing it does not close the access.
Affected
- JuggleIM im-server through 1.8.16 (CVE record: affected 0 to <= 1.8.16)
- Default configuration: admin console on port 8090 with default login admin/123456
Fixed in
Unknown.
Workaround
- Change the default admin/123456 credentials to a strong, unique password immediately after deployment.
- Restrict network access to the admin console on port 8090 (for example firewall or VPN only).
- Monitor for re-creation of the default admin account.
Exploitation
- CISA SSVC (CISA ADP, Vulnrichment): exploitation status 'poc', automatable 'yes', technical impact 'total'.
- Not listed in CISA KEV.
- Conflicting information on public exploit code; no confirmed exploitation in the wild found.
- EPSS below 1%.
Our recommendation
- Check immediately whether port 8090 is reachable from untrusted networks, including via reverse proxies or public interfaces.
- Change the default admin credentials or disable the admin console where possible.
- Rotate tenant app secrets if the console may have been reached, and review admin logins and tenant changes.
- Monitor for re-creation of the default admin account.
- Apply a fixed version as soon as the vendor publishes one; no fix is known at the time of writing.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-Eintrag bei OpenCVE app.opencve.io
- VulnCheck advisory www.vulncheck.com
- HackMD write-up hackmd.io
- im-server repository github.com
- imserver-console accountservice.go (v1.0.10) github.com
- im-server sql/imserver.sql (v1.8.16) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:33.
Original description (NVD)
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.
NVD references (6)
- https://github.com/juggleim/im-server
- https://github.com/juggleim/im-server/blob/v1.8.16/sql/imserver.sql#L988
- https://github.com/juggleim/imserver-console/blob/v1.0.10/services/accountservice.go#L77-L96
- https://hackmd.io/@hieuPenguinnn/juggleim-im-server-default-admin-credential
- https://www.vulncheck.com/advisories/juggleim-im-server-through-1.8.16-default-admin-credentials-in-admin-con…
- https://hackmd.io/@hieuPenguinnn/juggleim-im-server-default-admin-credential
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.