CVE-2026-111330

EUVD-2026-102484
JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using precomputed tables or GPU brute force.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/juggleim/im-server
https://github.com/juggleim/im-server/blob/v1.8.16/sql/imserver.sql#L3-L15
https://github.com/juggleim/imserver-console/blob/v1.0.10/services/accountservice.go#L95
https://hackmd.io/@hieuPenguinnn/juggleim-im-server-default-admin-credential
https://www.vulncheck.com/advisories/juggleim-im-server-through-1.8.16-weak-password-hashing-via-unsalted-sha-1