JuggleIM im-server up to version 1.8.16 stores admin console passwords in the database using an unsalted SHA‑1 hash. This weak hashing method, identified as CWE‑916, is vulnerable to precomputed rainbow tables and rapid GPU brute‑force cracking. As a result, an attacker who can read the accounts table, for instance through compromised database access or a leaked backup, can recover admin credentials and gain full administrative control over the server, compromising confidentiality, integrity, and availability of the chat platform.

The vulnerability affects the JuggleIM im-server product version 1.8.16. Vendors listed by the CNA are JuggleIM. No other affected versions are specified in the CNA data.

The CVSS base score of 8.2 indicates a high severity vulnerability. Because the attacker must obtain the accounts table, the likelihood of exploitation depends on database security; if an attacker has database access or can obtain a backup, they can efficiently crack the SHA‑1 hashes. The EPSS score of 0.00222 indicates a very low probability of exploitation, and the vulnerability is not in the CISA KEV catalog. The attack vector is thus limited to compromised database or backup access rather than remote network exploitation.