Skip to content
CVSS 9.8 · CRITICAL

CVE-2026-25660

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the URL ends with Authentication with certain function calls.  This bypass allows assigning arbitrary permission to any user existing in CodeChecker. This issue affects CodeChecker: through 6.27.3.

View on NVD

Analysis

CodeChecker, a popular tool for managing Clang Static Analyzer and Clang Tidy results, is vulnerable to a critical authentication bypass in versions up to 6.27.3. Attackers can exploit specific URL patterns to bypass authentication and assign themselves administrative permissions. Development teams using CodeChecker to track code defects should update to a patched version immediately.

Severity

Score: 9.8(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: UNCHANGED
C: HIGH
I: HIGH
A: HIGH
Weakness (CWE): CWE-290CWE-863

EPSS

Probability of exploitation (next 30 days): 0.0007 (0.1%)
Percentile: 21.1%
EPSS: 2026-05-06

Affects

ericsson:codechecker

Technical description

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the URL ends with Authentication with certain function calls.  This bypass allows assigning arbitrary permission to any user existing in CodeChecker. This issue affects CodeChecker: through 6.27.3.

Published: 4/24/2026, 2:16:18 PM
Last modified: 4/27/2026, 2:48:20 PM

References

HomeEventsBlogResourcesTeam