Vulnerability · Published Jul 18, 2025 · Assigned by VulDB

CVE-2025-7789Xuxueli xxl-job Token Generation IndexController.java makeToken weak password hash

Low 3.7

In plain English

A low-severity security flaw in xxl-job from Xuxueli. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.3%top 73.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function makeToken of the file src/main/java/com/xxl/job/admin/controller/IndexController.java of the component Token Generation. The manipulation leads to password hash with insufficient computational effort. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	com.xuxueli:xxl-job-admin	3.2.0	GHSA-565h-44m8-4c2v

Affected products (as reported)

Vendor	Product	Versions
Xuxueli	xxl-job	3.1.03.1.1

Weakness: CWE-916, CWE-326 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References

VDB-316850 | Xuxueli xxl-job Token Generation IndexController.java makeToken weak password hash vdb-entry, technical-description
VDB-316850 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #615760 | Xuxueli https://github.com/xuxueli/xxl-job <=3.1.1 Use of a Broken or Risky Cryptographic Algorithm vulnerability ( third-party-advisory
https://github.com/xuxueli/xxl-job/issues/3751 exploit, issue-tracking