CVE-2025-2322 is a high severity (CVSS 7.3) hard-coded credentials flaw in the open source springboot-openai-chatgpt project, in OpenController.java. The record says the product has no versioning and the vendor did not respond, so no fixed version exists to name. Review your use and remove or patch the code yourself.
What's affected
The NVD record, written by VulDB, says the issue was found in springboot-openai-chatgpt at commit e84f6f5, in the file chatgpt-boot/src/main/java/org/springblade/modules/mjkj/controller/OpenController.java. The manipulation leads to hard-coded credentials and can be started remotely.
The record says the product does not use versioning, so information about affected and unaffected releases is unavailable. It also says the vendor was contacted early and did not respond, and that the exploit has been disclosed to the public. The VulDB page could not be fetched for this review, so nothing beyond the record is added. No fixed version is known. Treat every copy of this code as affected.
How to check if you're exposed
If you forked or deployed the project, search for secrets in the code and in git history:
git log -S"password" --oneline
grep -rn "OpenController" src/
Open OpenController.java and look for literal passwords, tokens or keys. Check the deployed service's configuration for the same values. Also check whether the endpoints in that controller are reachable from outside your network.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Find every deployment or fork of springboot-openai-chatgpt in your organization.
- Review OpenController.java and remove any hard-coded credentials, moving secrets to environment variables or a secret store.
- Rotate any credential that was in the code, and treat it as exposed.
- Restrict network access to the service until the review is finished.
- Consider replacing the project with a maintained alternative, since the vendor has not responded.
Why it matters
CWE-798 is use of hard-coded credentials and CWE-259 is use of a hard-coded password. When a secret is written into source code, everyone with the source has it, and it cannot be rotated without a code change. For an open source repository, that means the world has it.
Projects without releases are a supply chain risk because scanners and version checks have nothing to match on. Teams that copied the code into an internal tree may not know it is there. The KEV flag is false. The record says the exploit is public, which is a reason to review quickly, but it does not state any observed attacks.
Quick check
Is there a patch?
No fixed version is listed. The record says the product does not use versioning and the vendor did not respond.
What should I do first?
Find where the code is used, check OpenController.java for secrets, and rotate any you find.
Sources
Last reviewed: 19 October 2026.
