What is the CVSS score of EUVD-2025-16746?

EUVD-2025-16746 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.8%.

Is there a public PoC exploit available for EUVD-2025-16746?

Yes, a public proof-of-concept exploit is available for EUVD-2025-16746. Prioritise patching immediately. EPSS: 0.8%.

How to fix or mitigate EUVD-2025-16746?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Audit authentication configurations.

Pekko Management EUVD-2025-16746

Q: Which versions of Pekko Management are affected by EUVD-2025-16746?

CVE-2025-46548 presents notable security risk, a improper authentication vulnerability rated CVSS 6.5. This could allow unauthorized access to protected resources.. A patch is available.

| CVE-2025-46548 MEDIUM

Improper Authentication (CWE-287)

2025-06-03 security@apache.org

GHSA-9qvj-rpj8-v5c8

Authentication Bypass Apache Java Akka Management Pekko Management Akka

6.5

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-287 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Authentication mechanism validation MITRE ATT&CK 2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	Unauthorized access to protected functionality, data, or administrative interfaces, potentially leading to full system compromise. With a CVSS score of 6.5 (MEDIUM), this represents a moderate risk.
Exploit ScenarioDerived	An attacker manipulates authentication tokens, exploits logic flaws, or uses default credentials to bypass the login mechanism and access restricted areas.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.8% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 14, 2026

If you enable Basic Authentication in Pekko Management using the Java DSL, the authenticator may not be properly applied.

Users that rely on authentication instead of making sure the Management API ports are only available to trusted users are recommended to upgrade to version 1.1.1, which fixes this issue.

Akka was affected by the same issue and has released the fix in version 1.6.1.

Earlier versions of this analysis (1)

v1 Mar 14, 2026 - 17:04 CVSS 6.5

RemediationAI

A vendor patch is available — apply it immediately. Implement robust authentication mechanisms. Use multi-factor authentication. Review authentication logic for bypass conditions. Remove default credentials.

Affected VersionsENISA

Apache Pekko Management 1.0.0 <1.1.1

Akka Management 0 <1.6.1

Affected Packages

maven com.lightbend.akka.management:akka-management_2.12 fix: 1.6.1

maven com.lightbend.akka.management:akka-management_2.13 fix: 1.6.1

maven com.lightbend.akka.management:akka-management_3 fix: 1.6.1

maven org.apache.pekko:pekko-management_2.12 fix: 1.1.1

maven org.apache.pekko:pekko-management_2.13 fix: 1.1.1

maven org.apache.pekko:pekko-management_3 fix: 1.1.1

euvd akka_management fix: 1.6.1

euvd apache_pekko_management fix: 1.1.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 8 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

An authentication bypass vulnerability allows attackers to circumvent login mechanisms and gain unauthorized access without valid credentials. This vulnerability is classified as Improper Authentication (CWE-287).

Know when Pekko Management gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 14, 2026 - 17:04 nvd

Patch available

PoC Detected

Jul 02, 2025 - 14:19 vuln.today

Public exploit code

CVE Published

Jun 03, 2025 - 15:15 nvd

MEDIUM 6.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 maven packages depend on org.apache.pekko:pekko-management_2.12 (4 direct, 0 indirect)
16 maven packages depend on org.apache.pekko:pekko-management_2.13 (5 direct, 11 indirect)
20 maven packages depend on org.apache.pekko:pekko-management_3 (5 direct, 15 indirect)

Ecosystem-wide dependent count for version 1.1.1 and other introduced versions.

Executive ViewAI

Why It Matters

CVE-2025-46548 presents notable security risk, a improper authentication vulnerability rated CVSS 6.5. This could allow unauthorized access to protected resources. Proof-of-concept code is publicly available. A patch is available and should be applied during regular vulnerability management.

Business Impact: Moderate

Compensating Controls

Apply vendor patch. If patching is delayed: restrict network access, enable MFA, monitor auth logs.

Threat Intelligence Overview

EPSS Score

0.8%

Top 26% exploitable

Exploit

POC

Public exploit code exists

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC Yes

EPSS 0.8%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.