Vendor
JuggleIM im-server versions through 1.8.16 contain a hardcoded administrator account that allows unauthenticated remote attackers to gain full administrative access to tenant applications and secrets via the console on port 8090.