CVE-2026-25660 - Vulnerability Analysis
CriticalCVSS: 9.8Last Updated: April 27, 2026
CodeChecker - Authentication Bypass
Overview
CodeChecker through 6.27.3 contains an authentication bypass caused by URL ending with Authentication and certain function calls, letting attackers assign arbitrary permissions to any existing user, exploit requires crafted URL.
Severity & Score
Impact
Attackers can assign arbitrary permissions to any user, potentially leading to full privilege escalation.
Mitigation
Update to the latest version beyond 6.27.3.
Social Media Activity(2 posts)
Ericsson CodeChecker (≤6.27.3) is vulnerable to CRITICAL auth bypass (CVE-2026-25660). Attackers can assign permissions via crafted URLs. Restrict access & monitor for changes. Patch not yet available. https://radar.offseq.com/threat/cve-2026-25660-cwe-290-authentication-bypass-by-sp-881e021f #OffSeq #vulnerability #CodeChecker #infosec
View original post
Ericsson CodeChecker (≤6.27.3) is vulnerable to CRITICAL auth bypass (CVE-2026-25660). Attackers can assign permissions via crafted URLs. Restrict access & monitor for changes. Patch not yet available. https://radar.offseq.com/threat/cve-2026-25660-cwe-290-authentication-bypass-by-sp-881e021f #OffSeq #vulnerability #CodeChecker #infosec
View original postRelated Resources
Details
- CVE ID
- CVE-2026-25660
- Severity
- Critical
- CVSS Score
- 9.8
- Type
- broken_authentication
- Status
- confirmed
- EPSS
- 5.4%
- Social Posts
- 2
CWE
- CWE-290
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H