{"id":"CVE-2026-25660","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-25660","generatedAt":"2026-10-28T03:29:11.080Z","title":"Authentication bypass occurs when the URL ends with Authentication with certain function calls.","description":"CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. \nAuthentication bypass occurs when the URL ends with Authentication with certain function calls.  This bypass allows assigning arbitrary permission to any user existing in CodeChecker.\n\nThis issue affects CodeChecker: through 6.27.3.","published":"2026-04-24T14:16:18.000Z","lastModified":"2026-10-26T22:10:00.000Z","status":"Analyzed","sourceIdentifier":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf","cvss":{"version":"4.0","score":9.3,"severity":"CRITICAL","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-290","CWE-863"],"affected":["ericsson/codechecker"],"epss":{"score":0.00447,"percentile":0.38621,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.45%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://github.com/Ericsson/codechecker/security/advisories/GHSA-4v9x-cqc5-j645","tags":["Vendor Advisory"],"source":"85b1779b-6ecd-4f52-bcc5-73eac4659dcf"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-25660","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}