Critical severity · published Apr 24, 2026
CVE-2026-25660
Authentication bypass for certain API calls
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.
Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permission to any user existing in CodeChecker.
This issue affects CodeChecker: through 6.27.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
CodeChecker · Ericsson
through 6.27.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25660
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25660
Vendor Advisory
https://github.com/Ericsson/codechecker/security/advisories/GHSA-4v9x-cqc5-j645
More from CodeChecker
10.0
CVE-2024-10081
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy
9.0
CVE-2024-10082
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy
8.2
CVE-2024-53829
Cross-Site Request Forgery in CodeChecker API
7.8
CVE-2025-40843
Buffer overflow in CodeChecker log command
6.5
CVE-2023-49793
Path traversal in `CodeChecker server` in the endpoint of `CodeChecker store`