CVE-2025-46548 Pekko Management may not properly apply authenticator when Basic Authentication is enabled
Attackers can bypass basic authentication in Pekko/Akka Management API when enabled via Java DSL, exposing management endpoints to unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-46548?
CVE-2025-46548 is a medium-severity authentication bypass vulnerability in Apache Software Foundation Akka Management, published on 3 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
If you enable Basic Authentication in Pekko Management using the Java DSL, the authenticator may not be properly applied.
Users that rely on authentication instead of making sure the Management API ports are only available to trusted users are recommended to upgrade to version 1.1.1, which fixes this issue.
Akka was affected by the same issue and has released the fix in version 1.6.1.
Weakness: CWE-287
Which versions are affected by CVE-2025-46548?
12 open source packages ship an affected version, including com.lightbend.akka.management:akka-management_2.12, com.lightbend.akka.management:akka-management_2.13 and com.lightbend.akka.management:akka-management_3. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
com.lightbend.akka.management:akka-management_2.12 Maven | All versions | 1.6.1 |
com.lightbend.akka.management:akka-management_2.12 Maven | All versions | 1.6.1 |
com.lightbend.akka.management:akka-management_2.13 Maven | All versions | 1.6.1 |
com.lightbend.akka.management:akka-management_2.13 Maven | All versions | 1.6.1 |
com.lightbend.akka.management:akka-management_3 Maven | All versions | 1.6.1 |
com.lightbend.akka.management:akka-management_3 Maven | All versions | 1.6.1 |
6 more packages
org.apache.pekko:pekko-management_2.12 Maven | All versions | 1.1.1 |
org.apache.pekko:pekko-management_2.12 Maven | All versions | 1.1.1 |
org.apache.pekko:pekko-management_2.13 Maven | All versions | 1.1.1 |
org.apache.pekko:pekko-management_2.13 Maven | All versions | 1.1.1 |
org.apache.pekko:pekko-management_3 Maven | All versions | 1.1.1 |
org.apache.pekko:pekko-management_3 Maven | All versions | 1.1.1 |
Products include Akka Akka Management, Apache Pekko Management.
How do I fix CVE-2025-46548?
Upgrade com.lightbend.akka.management:akka-management_2.12 to 1.6.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-46548 being exploited?
There is no known exploitation of CVE-2025-46548 in the wild and no public exploit code.
Sources
Also known as GHSA-9qvj-rpj8-v5c8.