CVE-2020-28452: Cross-Site Request Forgery in com.softwaremill.akka-http-session:core_2.12
Summary
CVE-2020-28452: Cross-Site Request Forgery in com.softwaremill.akka-http-session:core_2.12. Affects com.softwaremill.akka-http-session:core_2.12 versions >= 0.3.0, < 0.6.1. Fixed in 0.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.softwaremill.akka-http-session:core_2.12 package is a component of the Akka HTTP Session library. It provides session management capabilities for Akka HTTP applications. The library allows developers to store session data and manage session tokens securely. However, a vulnerability has been discovered in versions prior to 0.6.1 of the com.softwaremill.akka-http-session:core_2.12 package, as well as all versions of com.softwaremill.akka-http-session:core_2.11 and com.softwaremill.akka-http-session:core_2.13. This vulnerability allows for Cross-Site Request Forgery (CSRF) attacks to bypass the CSRF protection mechanism.
Vulnerability Detail
The CSRF protection in the com.softwaremill.akka-http-session:core_2.12 package can be bypassed by forging a request that contains the same value for both the X-XSRF-TOKEN header and the XSRF-TOKEN cookie value. The vulnerability lies in the randomTokenCsrfProtection check, which only verifies that the two values are equal and non-empty. This allows an attacker to craft a malicious request that tricks the server into accepting it as a legitimate request, potentially leading to unauthorized actions being performed on behalf of the victim user. The impact of this vulnerability can range from unauthorized data modifications to account takeover.
How To Fix
Latest published version: 0.7.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.6.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a secure version of the com.softwaremill.akka-http-session:core_2.12 package.
Conclusion
The com.softwaremill.akka-http-session:core_2.12 package is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a bypass in the CSRF protection mechanism. To mitigate this vulnerability, it is essential to upgrade to version 0.6.1 or later of the package. Failure to address this vulnerability may lead to unauthorized actions being performed on behalf of users. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.softwaremill.akka-http-session:core_2.12 →
FAQ
com.softwaremill.akka-http-session:core_2.12 is a package that provides session management capabilities for Akka HTTP applications.
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into submitting a malicious request. In this vulnerability, the CSRF protection mechanism can be bypassed, allowing an attacker to forge requests that appear legitimate.
The impact of this vulnerability can range from unauthorized data modifications to account takeover. An attacker can perform actions on behalf of the victim user without their consent.
To fix this vulnerability, it is recommended to upgrade to version 0.6.1 or later of the com.softwaremill.akka-http-session:core_2.12 package.
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to a secure version of the com.softwaremill.akka-http-session:core_2.12 package.
