CVE-2026-111329

JuggleIM im-server through 1.8.16 ships default admin credentials allowing unauthenticated remote access to the admin console.

The JuggleIM im-server product ships with hardcoded default administrator credentials (admin/123456) that persist even after account deletion, enabling unauthenticated remote attackers to access the admin console and control tenant applications. For DIB organizations, this represents a severe default-creds failure that bypasses standard authentication controls and directly violates CMMC/NIST 800-171 requirements for access control and credential management. Organizations must immediately patch to 1.8.17+ and audit for any deployed instances using default credentials.

Shame score — Shipping default credentials that persist after account deletion is a negligent, avoidable failure that directly enables unauthenticated remote access to administrative functions.