CVE-2026-25660Critical▾ MidnightCodechecker has an authentication bypass for certain API calls
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 52.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permissions to any existing user in CodeChecker.
The following functions are affected under the Authentication endpoint: getAuthorisedNames, getPermissionsForUser, hasPermission, addPermission, and removePermission.
The vulnerability allows unauthenticated users to execute these function calls with arbitrary arguments. In the logs, the exploit shows as follows:
[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@getAuthorisedNames
[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@addPermission
An attacker with a CodeChecker user can effectively acquire superuser permissions by calling these endpoints.
A patch is available at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4.
codechecker <= 6.27.3Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-1300Medium· 6.1CodeChecker open redirect when URL contains multiple slashes after the product name
CVE-2021-44217MediumCross-site Scripting in Ericsson CodeChecker
CVE-2025-40843Medium· 5.9CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy
CVE-2026-114612Critical· 9.9LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
CVE-2026-107336Medium· 6.5Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite
CVE-2026-62224Medium· 5.4OpenClaw MS Teams before 2026.5.12 contain an authorization bypass vulnerability where the allowFrom feature binds to mutable display names