Miggo Logo
Miggo Vulnerability Database
→
CVE-2025-61778

CVE-2025-61778: Akka.Remote TLS did not properly implement certificate-based authentication

N/A

CVSS Score

Basic Information

CVE ID
CVE-2025-61778
GHSA ID
GHSA-jhpv-4q4f-43g5
EPSS Score
0.13293%
CWE
CWE-290
Published
10/7/2025
Updated
10/7/2025
KEV Status
No
Technology
TechnologyC#

Technical Details

CVSS Vector
-
Package NameEcosystemVulnerable VersionsFirst Patched Version
Akka.Remotenuget>= 1.2.0, < 1.5.521.5.52
Akka.Clusternuget>= 1.2.0, < 1.5.521.5.52

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability, CVE-2025-61778, is a critical authentication bypass in Akka.Remote's TLS implementation. The root cause is the failure to enforce mutual TLS (mTLS), where both the client and server must authenticate each other using certificates.

My analysis of the patches shows two main issues were addressed:

  1. Lack of Mutual Authentication: The primary vulnerability was that the server-side TLS pipeline, configured in Akka.Remote.Transport.DotNetty.DotNettyTransport.SetServerPipeline, did not require connecting clients to present a certificate. Simultaneously, the client-side pipeline, configured in Akka.Remote.Transport.DotNetty.DotNettyTransport.SetClientPipeline, was not set up to offer a client certificate. This allowed any unauthenticated client to connect to a TLS-enabled Akka.NET cluster, completely bypassing the intended certificate-based security.

  2. No Fail-Fast on Misconfiguration: A related security weakness was found in the Akka.Remote.Transport.DotNetty.DotNettyTransport.Listen method. The system would start up without verifying if the server certificate's private key was actually accessible. This could lead an administrator to believe the system was secure, when in fact it was either non-functional or improperly secured. The patch introduced the Akka.Remote.Transport.DotNetty.SslSettings.ValidateCertificate method to perform this check at startup.

The identified vulnerable functions are the exact locations where these flawed logic patterns existed. During an exploit, an attacker's malicious client would connect to a vulnerable server, and the SetServerPipeline function on the server would be instrumental in incorrectly establishing the unauthenticated connection.

Vulnerable functions

Akka.Remote.Transport.DotNetty.DotNettyTransport.SetServerPipeline
src/core/Akka.Remote/Transport/DotNetty/DotNettyTransport.cs
This function sets up the server-side network pipeline. The original implementation configured the TLS handler to only perform server-side authentication, without requiring or validating a certificate from the connecting client. This allowed any client, even one without a valid certificate, to establish a TLS connection, bypassing certificate-based authentication. The vulnerability is the failure to enforce mutual TLS (mTLS).
Akka.Remote.Transport.DotNetty.DotNettyTransport.SetClientPipeline
src/core/Akka.Remote/Transport/DotNetty/DotNettyTransport.cs
This function sets up the client-side network pipeline. The original implementation did not configure the client to present its own certificate to the server during the TLS handshake. This is the client-side counterpart to the server's failure to require a certificate. While the primary flaw is the server's lack of enforcement, this function is part of the vulnerable workflow, as it demonstrates the lack of mutual authentication from the client's perspective.
Akka.Remote.Transport.DotNetty.DotNettyTransport.Listen
src/core/Akka.Remote/Transport/DotNetty/DotNettyTransport.cs
This function starts the server-side transport listener. Prior to the patch, it did not validate whether the configured SSL certificate's private key was accessible at startup. This allowed a server to start and appear healthy even with a misconfigured or inaccessible certificate, creating a false sense of security. The actual connection would fail at runtime during the TLS handshake. The vulnerability was the lack of fail-fast validation, which was fixed by adding a call to `Settings.Ssl.ValidateCertificate()` at the beginning of the function.
Akka.Remote.Transport.DotNetty.SslSettings.ValidateCertificate
src/core/Akka.Remote/Transport/DotNetty/DotNettyTransportSettings.cs
This function was added to fix a vulnerability where the server would start without a valid private key. The original code in the SslSettings constructors did not properly validate private key access. The absence of this validation logic is the vulnerability. This function, added by the patch, now performs the necessary checks on the certificate's private key (both RSA and ECDSA) to ensure it is accessible, preventing the server from starting in an insecure or non-functional state.

WAF Protection Rules

WAF Rule

### Imp**t T*is is * *riti**l n*twork s**urity vuln*r**ility *or *kk*.R*mot* **us*rs w*o **v* SSL / TLS *n**l**** on t**ir *kk*.R*mot* *onn**tions *n* w*r* *xp**tin* **rti*i**t*-**s** *ut**nti**tion to ** *n*or*** on *ll p**rs *tt*mptin* to join t**

Reasoning

T** vuln*r**ility, *V*-****-*****, is * *riti**l *ut**nti**tion *yp*ss in *kk*.R*mot*'s TLS impl*m*nt*tion. T** root **us* is t** **ilur* to *n*or** mutu*l TLS (mTLS), w**r* *ot* t** *li*nt *n* s*rv*r must *ut**nti**t* **** ot**r usin* **rti*i**t*s.