GrepRules
Sign inPublish rule
Explore/cve-2025-46548-pekko-akka-management-auth-bypass

CVE-2025-46548: Pekko Akka Management Auth Bypass

Using `toScala` from `scala.compat.java8` to convert a Java `CompletionStage` within a Pekko/Akka Management Java DSL authenticator causes an improper execution model mapping. This results in the authentication directive failing open, completely bypassing Basic Authentication. Use `.asScala` from `scala.jdk.FutureConverters` instead.

Provally CuratedPublic repositoryMediumMedium confidenceVerifiedApache-2.0Scalaβ
greprules fetch cve-2025-46548-pekko-akka-management-auth-bypass --engine opengrep

Description

Using `toScala` from `scala.compat.java8` to convert a Java `CompletionStage` within a Pekko/Akka Management Java DSL authenticator causes an improper execution model mapping. This results in the authentication directive failing open, completely bypassing Basic Authentication. Use `.asScala` from `scala.jdk.FutureConverters` instead.

License
Apache-2.0
Source context
Public repository
Source
Provally CVE rule catalog
Validation status
Verified
Quality signals
145 downloads0 direct145 via packs
· 0 stars · Quality score 68How quality works
Included packs
2 packs