CVE-2026-111330

MEDIUM 5.9

JuggleIM im-server through 1.8.16 Weak Password Hashing via Unsalted SHA-1

CVSS Score

5.9

EPSS Score

0.0%

EPSS Percentile

0th

JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using precomputed tables or GPU brute force.

CWE	CWE-916
Vendor	juggleim
Product	juggleim
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for juggleim juggleim

Be the first to know when new medium vulnerabilities affecting juggleim juggleim are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

juggleim / JuggleIM

0 ≤ 1.8.16

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@hieuPenguinnn/juggleim-im-server-default-admin-credential github.com: https://github.com/juggleim/imserver-console/blob/v1.0.10/services/accountservice.go#L95 github.com: https://github.com/juggleim/im-server/blob/v1.8.16/sql/imserver.sql#L3-L15 github.com: https://github.com/juggleim/im-server vulncheck.com: https://www.vulncheck.com/advisories/juggleim-im-server-through-1.8.16-weak-password-hashing-via-unsalted-sha-1

Credits

hieuPenguinnn