CVE-2026-84155Medium· 5.3▾ SunlitCodeChecker's web server fails to fully invalidate a session token on logout when the server runs with more than one API worker process (the default). Each worker process maintains its own in-memory session cache; logout only clears the …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.1%
CodeChecker's web server fails to fully invalidate a session token on logout when the server runs with more than one API worker process (the default). Each worker process maintains its own in-memory session cache; logout only clears the cache of the single worker that handles the request (plus the shared database record). Other workers continue to honor the destroyed token from their stale in-memory copies until the session's lifetime expires. An attacker who has captured a valid token can therefore keep impersonating the user after the user has logged out.
CodeChecker < 6.29.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-84161Medium· 4.9Authenticated remote denial of service through unbounded zlib decompression in storeAnalysisStatistics
CVE-2026-84164None· 0.0Stored XSS in the static HTML report export, because json.dumps does not escape the markup character
CVE-2026-25660CriticalCodechecker has an authentication bypass for certain API calls
CVE-2025-40843Medium· 5.9CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy
CVE-2025-1300Medium· 6.1CodeChecker open redirect when URL contains multiple slashes after the product name
CVE-2021-44217MediumCross-site Scripting in Ericsson CodeChecker