Weak password hashing in JuggleIM im-server admin console
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
JuggleIM im-server through 1.8.16 stores admin console passwords as unsalted SHA-1 digests produced by tools.SHA1 in services/accountservice.go. An attacker who obtains the accounts table through database access or backups can crack these passwords using precomputed tables or GPU brute force, as described by CWE-916.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using precomputed tables or GPU brute force.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for JuggleIM.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-16 Threatist record created from CVE-2026-111330
- 2026-10-16 Priority changed: MEDIUM → LOW
- 2026-10-16 CISA SSVC decision points changed
References
More juggleim vulnerabilities
- TI-2026-75073 JuggleIM im-server Default Admin Credentials in Admin Console CVSS 4.0CRITICAL 9.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences