What’s Vulnerable › Vulnerabilities
CVE-2026-25660: Authentication bypass for certain API calls
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-24 · updated 2026-10-26
- Weakness: CWE-290
Description
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permission to any user existing in CodeChecker. This issue affects CodeChecker: through 6.27.3.
Affected products
- Ericsson CodeChecker: before 6.27.4 — fixed in 6.27.4
How to fix
Upgrade to a fixed version: Ericsson CodeChecker 6.27.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-25660 or the next vulnerability affects your stack