CVE-2026-111330: JuggleIM im-server through 1.8.16 Weak Password Hashing via Unsalted SHA-1
JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using precomputed tables or GPU brute force.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of JuggleIM im-server through 1.8.16 are exposed if an attacker can obtain the accounts table, such as through database access or database backups. The affected credentials are admin console passwords.
Does an attacker need access to the admin console to exploit this?
No. Exploitation begins with access to the accounts table or a backup containing it; the attacker can then attempt offline cracking of the stored SHA-1 password digests. No console authentication is required to perform the cracking.
Why does access to a backup matter?
Backups can contain the same accounts-table password hashes as the live database. Because the hashes are unsalted SHA-1, attackers can use precomputed tables or GPU-based brute force attempts without interacting with the running service.