CVE-2020-7780: Cross-Site Request Forgery in com.softwaremill.akka-http-session
Summary
CVE-2020-7780: Cross-Site Request Forgery. Affects com.softwaremill.akka-http-session:core_2.13 versions < 0.5.11. Fixed in 0.5.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The com.softwaremill.akka-http-session package is a library for managing session data in Akka HTTP applications. It provides functionality for encrypting and signing session data, as well as protecting against session hijacking and tampering. However, versions before 0.5.11 are vulnerable to a Cross-Site Request Forgery (CSRF) attack.
Vulnerability Detail
The vulnerability allows an attacker to bypass the randomTokenCsrfProtection mechanism by sending an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie. This can lead to unauthorized actions being performed on behalf of the victim user, potentially resulting in data breaches, account takeover, or other malicious activities.
How To Fix
Latest published version: 0.7.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.11
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately possible, a temporary workaround can be implemented by manually validating the CSRF token in the application code. This involves checking the presence and validity of the X-XSRF-TOKEN header and XSRF-TOKEN cookie before processing any sensitive requests. Here is an example of how to implement this workaround in Scala:
import akka.http.scaladsl.server.Directives._
import com.softwaremill.akka_http_session.CsrfDirectives._
val routes = randomTokenCsrfProtection {
// Your existing route definitions
}
Conclusion
The com.softwaremill.akka-http-session package versions before 0.5.11 are vulnerable to a Cross-Site Request Forgery (CSRF) attack. This can allow attackers to perform unauthorized actions on behalf of victim users. It is recommended to upgrade to version 0.5.11 or later to fix this vulnerability. If immediate upgrade is not possible, a temporary workaround can be implemented by manually validating the CSRF token in the application code. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.softwaremill.akka-http-session:core_2.13 →
FAQ
The vulnerability allows an attacker to perform unauthorized actions on behalf of a victim user, potentially leading to data breaches, account takeover, or other malicious activities.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file and the Vulert Playground will analyze it for open-source vulnerabilities, including this CSRF vulnerability.
Yes, the CVSS score for this vulnerability is 8.8, indicating a high severity level.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to patch or mitigate the vulnerability as soon as possible to prevent potential exploitation.
You can find more information about the fix and the vulnerability in the GitHub Advisory Database. Here is the link to the advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/02/GHSA-q42q-523g-3fwv/GHSA-q42q-523g-3fwv.json
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
