Threats tagged 'ghsa-fpm5-2wcj-vfr7'

CodeChecker versions prior to 6.24.2 contain an authentication method confusion vulnerability that allows an attacker to log in as the built-in root user via an external authentication service. The root user account is auto-generated, cannot be disabled, and has unconditional superuser permissions. An attacker only needs to know the root username, which is stored in the CodeChecker configuration, to gain full control of the instance through the web interface.