Vulnerability · Published Apr 24, 2026 · Assigned by ERIC

CVE-2026-25660Authentication bypass for certain API calls

Critical 9.3

In plain English

A critical-severity authentication bypass by spoofing in CodeChecker from Ericsson. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.4%top 61.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permission to any user existing in CodeChecker. This issue affects CodeChecker: through 6.27.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	codechecker	no fix listed	GHSA-4v9x-cqc5-j645
PyPI	codechecker	no fix listed	PYSEC-2026-317

Affected products (as reported)

Vendor	Product	Versions
Ericsson	CodeChecker	0 – through 6.27.3

Weakness: CWE-290, CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:M/U:Red

References

https://github.com/Ericsson/codechecker/security/advisories/GHSA-4v9x-cqc5-j645 vendor-advisory