JuggleIM im-server Hardcoded Administrator Credentials

JuggleIM im-server versions 1.8.16 and earlier ship with default hardcoded administrator credentials (admin/123456). This vulnerability allows unauthenticated remote attackers to access the administrative console, which is typically exposed on port 8090. Once authenticated, an attacker gains complete control over tenant applications and sensitive application secrets. The issue is exacerbated by the application's CheckLogin logic, which automatically recreates the administrator account if it is deleted by a user, preventing effective remediation through account removal. This creates a persistent unauthorized access vector for any publicly exposed instance.

Impact

Successful exploitation grants an attacker full administrative control over the JuggleIM im-server environment. This impact includes the unauthorized management of all hosted tenant applications and the exfiltration of critical application secrets. The vulnerability is considered highly severe (CVSS 9.8) because it allows for immediate, unauthenticated, and persistent compromise of sensitive messaging infrastructure.

Recommendation

Immediate action is required to restrict access to the administrative console and update the software.

• Restrict network access to the administrative console on TCP port 8090 to authorized management IP addresses only, using firewall or network security group policies.
• Upgrade to a patched version of JuggleIM im-server where the hardcoded credential default has been removed.
• Monitor authentication logs for successful logins to the admin console using the username "admin".
• Conduct a review of all tenant application secrets and keys for potential compromise if the instance was exposed to the internet.