CVE-2024-10081: CodeChecker Authentication Bypass Vulnerability
Summary
CVE-2024-10081: codechecker vulnerable to authentication bypass when using specifically crafted URLs. Affects codechecker versions < 6.24.2. Fixed in 6.24.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
CodeChecker is an open-source tool designed for managing and analyzing code quality, particularly in the context of static analysis. It provides a comprehensive API for users to interact with its functionalities, including product management and configuration. However, a critical vulnerability has been identified that allows unauthorized access to sensitive API endpoints, potentially compromising the integrity of the application.
Vulnerability Detail
The vulnerability arises from an authentication bypass that occurs when the API URL ends with 'Authentication', 'Configuration', or 'ServerInfo'. This flaw allows unauthenticated users to gain superuser access to all API endpoints except for the Authentication endpoint. As a result, attackers can query, add, modify, and delete products on the CodeChecker server without any authentication, posing a significant risk to data integrity and security.
How To Fix
Latest published version: 6.29.1 as of 23 Oct 2026
pip install --upgrade "codechecker==6.29.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.24.2
This is the first release that contains the fix.
pip install --upgrade "codechecker==6.24.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, restrict access to the CodeChecker API by implementing network-level controls or firewall rules that limit access to trusted IP addresses only. This will help mitigate the risk of unauthorized access until the package is updated.
Conclusion
The CVE-2024-10081 vulnerability in CodeChecker presents a serious risk due to its ability to allow unauthorized access to critical API functionalities. Users are strongly advised to update to the latest version to protect their applications from potential exploitation.
See every vulnerability recorded for codechecker →
FAQ
CVE-2024-10081 is a critical vulnerability in CodeChecker that allows unauthenticated users to bypass authentication and access sensitive API endpoints.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences include unauthorized access to all API functionalities, allowing attackers to manipulate product data and potentially compromise the entire application.
Yes, a patch is available in version 6.24.2 of CodeChecker. Users should upgrade to this version to mitigate the vulnerability.
If an immediate upgrade is not possible, implement network-level restrictions to limit access to the API until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for codechecker.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
