CVE-2026-25660

Authentication bypass for certain API calls

State: Published
Severity: 9.3 Critical
Published: Apr 24, 2026
Updated: Apr 24, 2026
Reserved: Feb 4, 2026

Description

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permission to any user existing in CodeChecker.

This issue affects CodeChecker: through 6.27.3.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:M/U:Red	ERIC

Weaknesses

CWE-290 Authentication bypass by spoofing
CWE-863 Incorrect Authorization

Affected Products

Product	Versions
CodeCheckerEricsson	6.27.3 and earlierAffectedfrom 6.27.4Not affected

References

https://github.com/Ericsson/codechecker/security/advisories/GHSA-4v9x-cqc5-j645vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.