---
id: CVE-2026-25660
aliases:
  - GHSA-4v9x-cqc5-j645
  - PYSEC-2026-317
title: Codechecker has an authentication bypass for certain API calls
summary: Codechecker has an authentication bypass for certain API calls
severity: critical
vendor: codechecker
product: codechecker
ecosystem: pip
affected:
  - codechecker <= 6.27.3
published: '2026-05-05'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T16:45:03.525213578Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-4v9x-cqc5-j645'
references:
  - url: >-
      https://github.com/Ericsson/codechecker/security/advisories/GHSA-4v9x-cqc5-j645
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-25660'
  - url: 'https://github.com/Ericsson/codechecker'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/codechecker/PYSEC-2026-317.yaml
  - url: 'https://pypi.org/project/codechecker'
  - url: 'https://github.com/advisories/GHSA-4v9x-cqc5-j645'
tags:
  - osv
  - pip
  - ghsa
epss: 0.00447
epssPercentile: 0.3869
cwe:
  - CWE-290
  - CWE-863
ingestedAt: '2026-10-27T16:32:34.344Z'
---

## Overview

### Summary
Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permissions to any existing user in CodeChecker.

### Details

The following functions are affected under the Authentication endpoint: `getAuthorisedNames`, `getPermissionsForUser`, `hasPermission`, `addPermission`, and `removePermission`.

The vulnerability allows unauthenticated users to execute these function calls with arbitrary arguments.
In the logs, the exploit shows as follows:
```
[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@getAuthorisedNames
[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@addPermission
```

### Impact
An attacker with a CodeChecker user can effectively acquire superuser permissions by calling these endpoints.

### Patch
A patch is available at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4.

## Affected packages

- `codechecker <= 6.27.3`

## Remediation

Refer to the advisory for the patched release.