CVE-2020-7780

This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie.

• CWE-352

• https://github.com/softwaremill/akka-http-session/commit/57f11663eecb84be03383d164f655b9c5f953b41Patch, Third Party Advisory
• https://github.com/softwaremill/akka-http-session/issues/74Third Party Advisory
• https://github.com/softwaremill/akka-http-session/issues/77Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-COMSOFTWAREMILLAKKAHTTPSESSION-1045352Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-COMSOFTWAREMILLAKKAHTTPSESSION-1046654Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-COMSOFTWAREMILLAKKAHTTPSESSION-1046655Patch, Third Party Advisory
• https://github.com/softwaremill/akka-http-session/commit/57f11663eecb84be03383d164f655b9c5f953b41Patch, Third Party Advisory
• https://github.com/softwaremill/akka-http-session/issues/74Third Party Advisory
• https://github.com/softwaremill/akka-http-session/issues/77Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-COMSOFTWAREMILLAKKAHTTPSESSION-1045352Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-COMSOFTWAREMILLAKKAHTTPSESSION-1046654Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-COMSOFTWAREMILLAKKAHTTPSESSION-1046655Patch, Third Party Advisory

Published

Nov 27, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-7774The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerabl…9.8
• CVE-2020-7775This affects all versions of package freediskspace. The vuln…9.8
• CVE-2020-7776This affects the package phpoffice/phpspreadsheet from 0.0.0…6.4
• CVE-2020-7777This affects all versions of package jsen. If an attacker ca…7.2
• CVE-2020-7778This affects the package systeminformation before 4.30.2. Th…7.3
• CVE-2020-7779All versions of package djvalidator are vulnerable to Regula…7.5
• CVE-2020-7781This affects the package connection-tester before 0.2.1. The…9.8
• CVE-2020-7782This affects all versions of package spritesheet-js. It depe…9.8
• CVE-2020-7784This affects all versions of package ts-process-promises. Th…9.8
• CVE-2020-7785This affects all versions of package node-ps. The injection …9.8
• CVE-2020-7786This affects all versions of package macfromip. The injectio…9.8
• CVE-2020-7787This affects all versions of package react-adal. It is possi…8.2