The JuggleIM im-server up to version 1.8.16 ships with a hard‑coded default administrator account using the credentials admin/123456. These credentials are active on the admin console listening on TCP port 8090 and are available even after an administrator account is deleted, because the CheckLogin function recreates it. An unauthenticated remote attacker can therefore log in as administrator, gaining unrestricted control over tenant applications and app secrets. This vulnerability is a flaw in credential handling (CWE‑1392) that permits unauthorized use of an existing credential and results in full administrative authority.

Host machines running JuggleIM im-server version 1.8.16 or earlier are affected. They expose the administrator console on port 8090. No other newer releases or separate products are mentioned as vulnerable in the provided data.

The CVSS score of 9.3 categorises the issue as critical. The EPSS score of < 1% indicates a very low but nonzero probability of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector is a remote network connection to TCP port 8090, with no authentication required, as the default credentials are hard‑coded. Once authenticated, the attacker can manipulate tenant applications and retrieve or modify app secrets, fully compromising the confidentiality, integrity, and availability of the services.