CVE-2026-25660: Codechecker Authentication Bypass Vulnerability

CRITICAL
Advisory Identifier: GHSA-4v9x-cqc5-j645
Share
CWE-863 CWE-290
Published
Advisory Summary

CVE-2026-25660 is a CRITICAL authentication bypass vulnerability (CWE-863: Incorrect Authorization) affecting Codechecker libraries in the PyPI ecosystem. The issue involves codechecker has an authentication bypass for certain api calls. Remediation is available in the latest vendor maintenance releases.

CVE-2026-25660 at a Glance

CVE Identifier CVE-2026-25660
GHSA Identifier GHSA-4v9x-cqc5-j645
Severity CRITICAL
CVSS v3.1 Base Score N/A
CWE Classification CWE-863: Incorrect Authorization
Affected Product Codechecker
Package Ecosystem PyPI
Published Date
Last Updated

How to Fix CVE-2026-25660

To remediate this vulnerability, upgrade all affected Codechecker dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

codechecker fixed: Latest secure release 
pip install codechecker>=Latest secure release
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show codechecker

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2026-25660, inspect your installed packages using pip:

pip show codechecker

Analyze the terminal output to locate any version of Codechecker in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The pip show codechecker command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-863: Incorrect Authorization, where the product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. In Codechecker, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permissions to any existing user in CodeChecker. ### Details The following functions are affected under the Authentication endpoint: `getAuthorisedNames`, `getPermissionsForUser`, `hasPermission`, `addPermission`, and `removePermission`. The vulnerability allows unauthenticated users to execute these function calls with arbitrary arguments. In the logs, the exploit shows as follows: ``` [INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@getAuthorisedNames [INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@addPermission ``` ### Impact An attacker with a CodeChecker user can effectively acquire superuser permissions by calling these endpoints. ### Patch A patch is available at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4.

CVE-2026-25660 Affected Codechecker Versions

1 component(s)
Product / Package Ecosystem Affected Versions Fixed Version
codechecker
pypi/codechecker
PyPI
≤ 6.27.3

References

GitHub Advisory / Wiki ADVISORY
https://github.com/Ericsson/codechecker/security/advisories/GHSA-4v9x-cqc5-j645
NVD — CVE-2026-25660 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25660
Codechecker Source Repository REPOSITORY
https://github.com/Ericsson/codechecker

Frequently Asked Questions

What is CVE-2026-25660?
CVE-2026-25660 is a security vulnerability in Codechecker involving Codechecker has an authentication bypass for certain API calls under CWE-863: Incorrect Authorization.
Which Codechecker versions are affected?
Affected versions include releases prior to current release patches across affected packages: codechecker.
What version fixes CVE-2026-25660?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
Is codechecker affected?
Yes, codechecker is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.
What CWE is associated with CVE-2026-25660?
CVE-2026-25660 is classified under CWE-863: Incorrect Authorization (The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.).
How can I check PyPI dependencies for CVE-2026-25660?
Run the dependency tree command: 'pip show codechecker'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-4v9x-cqc5-j645",
  "modified" : "2026-05-05T17:58:09Z",
  "published" : "2026-05-05T17:58:09Z",
  "aliases" : [ "CVE-2026-25660" ],
  "summary" : "Codechecker has an authentication bypass for certain API calls",
  "details" : "### Summary\nAuthentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permissions to any existing user in CodeChecker.\n\n### Details\n\nThe following functions are affected under the Authentication endpoint: `getAuthorisedNames`, `getPermissionsForUser`, `hasPermission`, `addPermission`, and `removePermission`.\n\nThe vulnerability allows unauthenticated users to execute these function calls with arbitrary arguments.\nIn the logs, the exploit shows as follows:\n```\n[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@getAuthorisedNames\n[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@addPermission\n```\n\n### Impact\nAn attacker with a CodeChecker user can effectively acquire superuser permissions by calling these endpoints.\n\n### Patch\nA patch is available at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "codechecker"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "6.27.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/Ericsson/codechecker/security/advisories/GHSA-4v9x-cqc5-j645"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-25660"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/Ericsson/codechecker"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-290", "CWE-863" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-05T17:58:09Z",
    "nvd_published_at" : "2026-04-24T14:16:18Z"
  }
}