CVE-2026-25660CWE-290CWE-863

Authentication bypass for certain API calls

Critical · published April 24, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
48.6
In the wild
Unconfirmed
What it is

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.

Authentication bypass occurs when the URL ends with Authentication with certain function calls.  This bypass allows assigning arbitrary permission to any user existing in CodeChecker.

This issue affects CodeChecker: through 6.27.3.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:M/U:Red
EPSS
0.00611 · 48.6th percentile
Weaknesses
CWE-290 · Authentication Bypass by Spoofing; CWE-863 · Incorrect Authorization
Published
2026-04-24T13:10Z
EPSS history
Timeline
  • 24 APR 13:10Z
    Authentication bypass for certain API calls
    cvelistv5