The vulnerability identified as CVE-2026-25660 affects Ericsson CodeChecker, a static analysis tooling and defect database viewer. It is an authentication bypass caused by URL manipulation where appending 'Authentication' with specific function calls bypasses normal authentication checks. This allows attackers to assign arbitrary permissions to any user in the system, effectively escalating privileges without authentication. The issue affects CodeChecker versions through 6.27.3. The CVSS 4.0 base score is 9.3, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official remediation or patch has been published by Ericsson as of the data provided.

Successful exploitation of this vulnerability allows an unauthenticated attacker to bypass authentication controls and assign arbitrary permissions to any existing user in CodeChecker. This can lead to unauthorized access and privilege escalation within the affected system, potentially compromising the confidentiality, integrity, and availability of the CodeChecker environment. Given the critical CVSS score, the impact is severe. However, there are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting access to CodeChecker instances to trusted users and networks only. Monitor for unusual permission changes or access patterns related to CodeChecker. Avoid exposing CodeChecker interfaces to untrusted networks. Follow Ericsson's official communications for updates on patches or mitigations.