CVE-2026-25660 Authentication bypass for certain API calls
Attackers can bypass authentication to assign arbitrary permissions to any user in CodeChecker, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-25660?
CVE-2026-25660 is a critical authentication bypass vulnerability in Ericsson CodeChecker, published on 24 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permission to any user existing in CodeChecker.
This issue affects CodeChecker: through 6.27.3.
Which versions are affected by CVE-2026-25660?
3 open source packages ship an affected version, including codechecker. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
codechecker PyPI | All versions to 6.27.3 | None |
codechecker PyPI | All versions to 6.27.3 | None |
codechecker PyPI | All versions to 6.27.3 | None |
Products include Ericsson Codechecker.
How do I fix CVE-2026-25660?
No fix has been published for CVE-2026-25660 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-25660 being exploited?
There is no known exploitation of CVE-2026-25660 in the wild and no public exploit code.
Other vulnerabilities in Ericsson CodeChecker
- CVE-2024-10081 codechecker vulnerable to authentication bypass when using specifically crafted URLs
- CVE-2024-10082 codechecker authentication method confusion vulnerability allows logging in as the built-in root user from an external service
- CVE-2024-53829 Cross-Site Request Forgery in CodeChecker API
- CVE-2023-49793 Path traversal in `CodeChecker server` in the endpoint of `CodeChecker store`
- CVE-2025-1300 Open redirect in CodeChecker web server
Sources
Also known as GHSA-4v9x-cqc5-j645, PYSEC-2026-317.