PT-2025-40934 · Akka+1 · Akka+1

Aaronontheweb · Published 2025-10-06 · Updated 2025-10-10 · CVE-2025-61778

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Akka.NET versions 1.2.0 through 1.5.51

Description Akka.NET, a .NET port of the Akka project, has an issue where the Akka.Remote component did not implement mutual TLS (mTLS) in versions 1.2.0 through 1.5.51. When TLS was enabled via the akka.remote.dot-netty.tcp transport, the server correctly validated private keys for inbound connections, but it did not require clients to present their certificates. This allowed untrusted parties to connect to a cluster secured with a private key and begin communicating without authentication. The issue was addressed by enforcing mTLS by default, requiring both parties to be keyed using the same certificate. A patch was also implemented to enforce "fail fast" semantics if TLS is enabled but the private key is missing or invalid. The vulnerability affects those running Akka.NET inside a private network or those who were not using TLS.

Recommendations Upgrade to Akka.NET version 1.5.52 or later. As a workaround, avoid exposing the application publicly.

Exploit

Fix

Missing Authentication

Authentication Bypass by Spoofing

Improper Certificate Validation

Weakness Enumeration

CWE-306

CWE-290

CWE-295

Related Identifiers

CVE-2025-61778

GHSA-JHPV-4Q4F-43G5

Affected Products

Akka

Akka.Net

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61778.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-61778 · Security Note
• https://osv.dev/vulnerability/GHSA-jhpv-4q4f-43g5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-61778 · Vendor Advisory
• https://github.com/akkadotnet/akka.net/pull/7851 · Note
• https://github.com/akkadotnet/akka.net/security/advisories/GHSA-jhpv-4q4f-43g5 · Note
• https://github.com/akkadotnet/akka.net/pull/7847 · Note
• https://github.com/akkadotnet/akka.net/releases/tag/1.5.52 · Note
• https://github.com/akkadotnet/akka.net · Note
• https://t.me/CVEtracker/34264 · Telegram Post
• https://twitter.com/CVEnew/status/1975248351537852507 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o30vje/resumen_diario_de_vulnerabilidades_10102025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1o120p5/resumen_diario_de_vulnerabilidades_08102025 · Reddit Post
• https://getakka.net/articles/remoting/security.html · Note
• https://t.me/pentestingnews/69300 · Telegram Post