CVE-2026-25660: CodeChecker Authentication Bypass Vulnerability
Summary
CVE-2026-25660: Codechecker has an authentication bypass for certain API calls. Affects codechecker versions < 6.27.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CodeChecker is an open-source tool designed for static analysis of C/C++ code, enabling developers to identify bugs and improve code quality. It provides various functionalities, including permission management for users. However, a critical vulnerability has been identified that allows unauthorized access to sensitive API functions, potentially compromising user permissions.
Vulnerability Detail
The vulnerability arises from an authentication bypass in CodeChecker's API, specifically affecting the Authentication endpoint. Certain function calls, such as getAuthorisedNames, getPermissionsForUser, hasPermission, addPermission, and removePermission, can be executed without proper authentication. This allows unauthenticated users to manipulate user permissions arbitrarily, leading to severe security implications, including unauthorized elevation of privileges. The logs indicate that these actions can be performed by anonymous users, highlighting the ease of exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, restrict access to the affected API endpoints by implementing additional authentication checks or firewall rules until the package can be updated.
Conclusion
The authentication bypass vulnerability in CodeChecker (CVE-2026-25660) poses significant security risks by allowing unauthorized manipulation of user permissions. It is crucial to update to the patched version 6.27.4 to ensure the security of your application. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for codechecker →
FAQ
CVE-2026-25660 is a vulnerability in CodeChecker that allows unauthorized users to bypass authentication and manipulate user permissions.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
The risks include unauthorized access to sensitive functions and the potential for an attacker to gain superuser permissions, compromising the security of the application.
Yes, a patch is available in version 6.27.4 of CodeChecker. It is recommended to update to this version to mitigate the vulnerability.
If immediate updating is not possible, implement additional authentication checks or restrict access to the affected API endpoints as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for codechecker.
