Summary
generated automatically from NVD dataJuggleIM im-server through 1.8.16 ships with default administrator credentials (admin/123456) that give unauthenticated remote attackers access to the admin console on port 8090. Because CheckLogin recreates the account even after it has been deleted, the administrator login remains available. An attacker who logs in can control tenant applications and their app secrets. The flaw is rated CRITICAL with a CVSS v3.1 score of 9.8 and is classified as CWE-1392.
NVD description
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.
EPSS · FIRST.org
0.53%probability of exploitation in the next 30 days
Higher than 43% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-18, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 15 oct. 2026
- Updated
- 16 oct. 2026
- Status
- Deferred
- Source
- disclosure@vulncheck.com
Weaknesses (CWE)
References (6)
Similar CVEs
Other vulnerabilities of type CWE-1392
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.