CVE-2026-25660: CodeChecker Authentication Bypass Vulnerability
Summary
CVE-2026-25660: Codechecker has an authentication bypass for certain API calls. Affects codechecker versions < 6.27.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CodeChecker is an open-source tool designed for static analysis of C/C++ code, providing functionalities such as bug detection and code quality improvement. It allows users to manage permissions and access control for various functionalities. However, it is vulnerable to an authentication bypass issue that can lead to unauthorized permission assignments.
Vulnerability Detail
The vulnerability arises from an authentication bypass that occurs when certain API calls are made to the Authentication endpoint. Specifically, functions like getAuthorisedNames, getPermissionsForUser, hasPermission, addPermission, and removePermission can be accessed without proper authentication. This allows unauthenticated users to manipulate permissions, potentially granting themselves superuser access. The exploit can be observed in logs where anonymous users successfully call these functions, indicating a severe security risk.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict access to the affected API endpoints by implementing additional network-level security measures, such as firewalls or API gateways, until the package can be updated.
Conclusion
The authentication bypass vulnerability in CodeChecker (CVE-2026-25660) poses a significant risk by allowing unauthorized users to manipulate permissions. It is crucial to update to the patched version to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for codechecker →
FAQ
The CVSS score of this vulnerability is 9.3, indicating a critical severity level.
Versions of CodeChecker from 0 up to 6.27.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
An attacker could exploit this vulnerability to gain unauthorized superuser permissions, allowing them to manipulate user access and permissions within CodeChecker.
Yes, a patch is available in version 6.27.4 of CodeChecker, which addresses the authentication bypass issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for codechecker.
