CVE-2025-14909: jeecg jeecg_boot Manage User Sessions

Vulnerability summary

CVE-2025-14909 is a high (CVSS 8.1) Manage User Sessions vulnerability in jeecg jeecg_boot. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 41.9% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 19-12-2025
   PublishedVulnerability first disclosed.
2. 19-12-2025
   Last modifiedVulnerability information updated.

Description

A weakness has been identified in JeecgBoot up to 3.9.0. The impacted element is the function SysUserOnlineController of the file jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysUserOnlineController.java. Executing manipulation can lead to manage user sessions. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. This patch is called b686f9fbd1917edffe5922c6362c817a9361cfbd. Applying a patch is advised to resolve this issue.

• CWE-1018Manage User SessionsWeaknesses in this category are related to the design and architecture of session management. Frequently these deal with the information or status about each user and their access rights for the duration of multiple requests. The weaknesses in this category could lead to a degradation of the quality of session management if they are not addressed when designing or implementing a secure architecture.