CVE-2025-4019 is a high severity flaw (CVSS 7.3) in Novel-Plus, a Java project from xxyopen. It affects the genCode function of GeneratorController.java, where the code generation feature answers callers that have not logged in. No fix is named, so restrict access and watch the repository.
What's affected
The record names Novel-Plus up to commit 0e156c04b4b7ce0563bef6c97af4476fcda8f160. For Novel-Plus the range is given as "up to" a specific commit, which means every build up to and including that commit, not a numbered release. The affected file is novel-admin/src/main/java/com/java2nb/common/controller/GeneratorController.java.
The record says the vendor was contacted early about the disclosure but did not respond in any way. It also says the exploit has been disclosed to the public and may be used. No fixed version or commit is named in the record, and I could not confirm one from the references, so check the project repository before assuming a fix exists.
The CVSS vector shows network access, low complexity and no privileges. That means the flaw can be reached without a login.
How to check if you're exposed
- Find out whether you run this project, or a fork of it. Search your repositories and servers for the package name com.java2nb or io.github.xxyopen.
- Find the commit or release you built from.
- Open GeneratorController.java and read how the function checks who is calling it.
- Check the access logs of the admin or author application for requests to the matching endpoint.
git log --oneline -1
grep -rn "genCode" --include=*.java .
Run these in your own checkout. The first line shows the commit you are on, and the second shows where the function lives.
What to do now
- Put the admin or author area behind a VPN, an allow list or a gateway that requires login, so the endpoint cannot be reached from the open internet.
- Disable or remove the code generator in any deployed build. A generator is a development tool and rarely belongs in production.
- Watch the project repository for a fix, and read the change before you merge it. If you maintain a fork, patch it yourself.
- Review logs for past calls to the endpoint and check whether data has changed that should not have.
- Keep a record of the decision, so the exposure is tracked until the fix lands.
Why it matters
The record maps this issue to CWE-287 (improper authentication) and CWE-306 (missing authentication for a critical function). A function that does real work should refuse callers that have not proved who they are. Here the record says it does not, which is a classic missing authentication problem.
This kind of flaw is easy to miss in testing because the feature works as designed for the right user. It only shows when someone tries the request as the wrong user. The score of 7.3 reflects the limited impact the record describes, not a licence to ignore it.
This CVE is not on the CISA Known Exploited Vulnerabilities list. The silent vendor is the bigger risk, because you may wait a long time for an upstream fix. Our free in-browser dependency scan can check the libraries in a Java project like this one, which is worth doing while you are looking at it.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version should I upgrade to?
The record does not name a fixed version or commit, and the vendor did not respond to the reporter. Check the project repository, and restrict access until a fix is confirmed.
Sources
The CVE record also lists third party write-ups and a VulDB entry. They are not vendor advisories, and this post does not reproduce any exploit detail from them.
Last reviewed: 18 October 2026.
