Weak Password Hashing in JuggleIM im-server Versions

CVE-2026-111330

What is CVE-2026-111330?

JuggleIM im-server up to version 1.8.16 has a significant vulnerability whereby admin console passwords are stored as unsalted SHA-1 hashes. This practice exposes passwords to potential compromise by attackers who can access the accounts table through database breaches or improper backups. Given the use of unsalted hashes, attackers can easily leverage precomputed hash tables or utilize GPU-based brute force attacks to gain unauthorized access to admin accounts. It is crucial for users to be aware of this vulnerability in order to implement necessary security measures and safeguard their systems.

References