CVE-2026-111330

Received Received - Intake

Weak Password Hashing in JuggleIM im-server

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using precomputed tables or GPU brute force.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111330

Affected Vendors & Products

Vendor	Product	Version / Range
juggleim	JuggleIM	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-916	The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

Attack-Flow Graph

Executive Summary

JuggleIM im-server through version 1.8.16 has a weak password hashing vulnerability where admin console passwords are stored as unsalted SHA-1 hashes in the accounts table. This flaw exists in services/accountservice.go via tools.SHA1. Attackers with access to the database or backups can crack these passwords using precomputed tables or GPU brute force attacks.

Detection Guidance

Check JuggleIM im-server versions up to 1.8.16 for unsalted SHA-1 password storage in the accounts table. Inspect services/accountservice.go for tools.SHA1 usage. Search database backups or live systems for SHA-1 hashes without salt in admin console passwords.

Impact Analysis

If you use JuggleIM im-server versions up to 1.8.16, attackers could gain access to the admin console by cracking stored passwords. This could lead to unauthorized control over the server, data breaches, or further network compromise. The risk is higher if database backups or access logs are exposed.

Compliance Impact

This vulnerability likely violates compliance requirements for secure password storage under GDPR and HIPAA. Both regulations mandate strong, salted hashing for passwords. Unsalted SHA-1 is considered weak and non-compliant, potentially leading to regulatory fines or legal consequences if exploited.

Mitigation Strategies

Upgrade JuggleIM im-server to a version beyond 1.8.16. Replace unsalted SHA-1 hashes with stronger algorithms like bcrypt or Argon2. Rotate all admin console passwords immediately. Restrict database access to prevent unauthorized table access.

Hi! I’m here to help you understand CVE-2026-111330. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70