CodeChecker, an analyzer tooling and defect database extension for Clang Static Analyzer and Clang Tidy, suffers from an authentication bypass vulnerability (CWE-290) identified as CVE-2026-25660. The bypass occurs when the URL ends with 'Authentication' and certain function calls are made, allowing attackers to assign arbitrary permissions to any user in the system. This issue affects CodeChecker versions through 6.27.3. The vulnerability is critical with a CVSS 4.0 score of 9.3, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been disclosed by Ericsson, and the product is not a cloud service.

Successful exploitation of this vulnerability allows an unauthenticated attacker to bypass authentication controls and assign arbitrary permissions to any existing user in CodeChecker. This can lead to unauthorized access and potential privilege escalation within the affected system. The high CVSS score reflects significant risk to confidentiality, integrity, and availability of the affected product. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to CodeChecker instances to trusted users and networks only. Monitor for unusual permission changes or access patterns. Avoid exposing CodeChecker interfaces to untrusted networks.