EUVD-2026-102483
GHSA-8775-m6vh-qqqm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach admin console on port 8090
-
ExploitLog in with default admin/123456
-
ExecutionObtain administrator session
-
ImpactControl tenant apps and exfiltrate app secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Default credential prevention
|
| Exploitation Conditions | Exploitable only when the JuggleIM admin console on TCP port 8090 is network-reachable AND the shipped default credentials admin/123456 have not been changed by the operator. No user interaction or prior authentication is required against such a default-configured deployment (through version 1.8.16). Notably, the CheckLogin routine recreates the admin account even after deletion, so simply deleting the admin user does not limit exploitation. The primary limiting factors are network exposure of port 8090 and whether an operator has rotated the default password. |
| Impact | All signals point to genuine high priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation with high confidentiality, integrity and availability impact (VC:H/VI:H/VA:H), scored 9.3 - consistent with CWE-1392 (use of default credentials). Default admin/123456 credentials on a network-exposed admin console (port 8090) require no attacker skill or setup, so the barrier to exploitation is essentially zero wherever the console is reachable and the password unchanged. No EPSS score, CISA KEV listing, or SSVC decision data was provided in the input, and no exploit code is referenced, so exploitation-probability and active-exploitation signals cannot be cross-referenced - treat this as 'trivially exploitable if exposed' rather than 'confirmed exploited.' The main mitigating reality is deployment footprint: JuggleIM is a niche open-source IM server, so this is a critical flaw in a product of limited prevalence rather than an internet-wide emergency. The persistence behavior (CheckLogin recreating the admin account even after deletion) means naive remediation by deleting the account does NOT work and must be explicitly verified. |
| Exploit ScenarioDerived | An attacker scans for internet-exposed JuggleIM admin consoles on TCP port 8090, then logs in using the shipped default credentials admin/123456 with no prior authentication. Once in, they control tenant applications and harvest app secrets, enabling impersonation or full compromise of the messaging platform. No public exploit code is referenced, but the network-reachable, low-complexity nature (AV:N/AC:L) makes manual exploitation trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Hard-coded administrator credentials (admin/123456) shipped in JuggleIM im-server through version 1.8.16 allow unauthenticated remote attackers to log in to the admin console exposed on TCP port 8090 and take control of tenant applications and their application secrets. Because the console's CheckLogin routine recreates the admin account whenever it is absent, deleting the default administrator does not remove the exposure - the account simply returns. Exploitation requires only that port 8090 is network-reachable and that the operator has not rotated the shipped password; no public exploit code was identified at time of analysis, although the vendor advisory, a public technical writeup, and the upstream SQL seed and login source are all publicly referenced.
RemediationAI
No patched version is identified in the provided data for im-server (affected through 1.8.16); confirm the current fix state against the upstream repository github.com/juggleim/im-server and the VulnCheck advisory at https://www.vulncheck.com/advisories/juggleim-im-server-through-1.8.16-default-admin-credentials-in-admin-console before planning an upgrade. The immediate, highest-value action is to log in to the admin console and rotate the administrator password away from admin/123456, then verify that the new password survives a service restart - this is the single control that actually removes the vulnerability, since deleting the admin account is ineffective (CheckLogin recreates it, per services/accountservice.go lines 77-96) and should not be relied on. Because the console governs tenant applications and their app secrets, any deployment that has been Internet-exposed on port 8090 must also be treated as potentially compromised: rotate tenant application secrets, review console audit logs and administrator sessions for unauthorized use, and rewrite the SQL seed template (sql/imserver.sql) in any rebuild or re-provisioning pipeline so new instances do not re-introduce the default account. As a compensating control for environments that cannot take the console offline immediately, block inbound TCP 8090 at the network perimeter and allow access only from a management VPN or bastion; the trade-off is that operators lose direct browser access to the console and must route through the bastion, while any pre-existing attacker session on the console would not be terminated by the firewall change alone, so a full restart and credential rotation are still required.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-1392 (Use of Default Credentials): the im-server distribution seeds an administrator account with the static, well-known password "123456" through its database initialization script (sql/imserver.sql, line 988 in the v1.8.16 tag), and the companion Go-based imserver-console service authenticates against that account (services/accountservice.go, lines 77-96 in v1.0.10). The console is a multi-tenant administration plane: authenticated control over it means control over tenant applications and the secrets those applications use, which is why the confidentiality, integrity and availability impacts are all high. The published CVSS 4.0 vector (9.3, AV:N/AC:L/AT:N/PR:N/UI:N) matches the independent CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in describing a fully unauthenticated, network-reachable attack requiring no user interaction; the two scores differ only in scoring framework, and both agree the prerequisites are network reachability of the admin console on TCP port 8090 plus a deployment still using the default credential. The CPE entry cpe:2.3:a:juggleim:juggleim:*:*:*:*:*:*:*:* is a wildcard, so it does not by itself bound the affected range; the operative boundary from the advisory is "through 1.8.16".
Know when Juggleim gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Remote console with unchanged default credentials means no authentication (PR:N) and low complexity (AC:L); administrator access yields full C/I/A impact within one application scope (S:U).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.
Executive ViewAI
JuggleIM im-server deployments up to version 1.8.16 ship with a fixed administrator login that anyone who can reach the management console on TCP port 8090 may be able to use, putting tenant applications and their stored secrets under third-party control. The exposure cannot be closed by simply deleting the default account, because the product recreates it automatically, so affected organizations remain at risk until the vendor issues a fix or the console is isolated. Leadership should treat this as a configuration-driven takeover risk for any internet-exposed or broadly reachable messaging infrastructure and prioritize containment over waiting for a patch.
No vendor-released patch identified at time of analysis. Interim mitigations: block or firewall TCP port 8090 so the admin console is reachable only from authorized management networks; place the console behind VPN or a bastion host; rotate the default administrator credentials and all tenant application secrets; disable or restrict the console where operationally feasible; monitor and alert on console authentication and configuration activity; note that deleting the default admin account does not remove the exposure because it is recreated automatically.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB