CVE-2026-111330
JuggleIM im-server through 1.8.16 Weak Password Hashing via Unsalted SHA-1
juggleim JuggleIM
CVSS
8.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using precomputed tables or GPU brute force.
Text from CVE List
Affected versions 1
- JuggleIMaffected: all versions through 1.8.16CVE List
References 5
- hackmd.io/@hieuPenguinnn/juggleim-im-server-default-admin-credentialAdvisoryvia CVE List
- vulncheck.com/advisories/juggleim-im-server-through-1.8.16-weak-password-hashing-via-unsalted-sha-1Advisoryvia CVE List
- github.com/juggleim/imserver-console/blob/v1.0.10/services/accountservice.go#L95Referencevia CVE List
- github.com/juggleim/im-server/blob/v1.8.16/sql/imserver.sql#L3-L15Referencevia CVE List
- github.com/juggleim/im-serverReferencevia CVE List