9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25660

CVE-2026-25660: Codechecker has an authentication bypass for certain API calls

Summary

Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permissions to any existing user in CodeChecker.

Details

The following functions are affected under the Authentication endpoint: getAuthorisedNames, getPermissionsForUser, hasPermission, addPermission, and removePermission.

The vulnerability allows unauthenticated users to execute these function calls with arbitrary arguments. In the logs, the exploit shows as follows:

[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@getAuthorisedNames
[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@addPermission

Impact

An attacker with a CodeChecker user can effectively acquire superuser permissions by calling these endpoints.

Patch

A patch is available at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25660

CVE-2026-25660:

9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
codechecker	pip	<= 6.27.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an authentication bypass in the CodeChecker API. The root cause lies in the BasePermissionHandler.has_permission function within web/server/codechecker_server/permissions.py. Prior to the fix, this function would return True if no authentication session was provided, incorrectly assuming that this meant server-wide authentication was disabled. An attacker could make unauthenticated POST requests to specific API endpoints, which would then call this flawed permission check, granting them access.

The patch addresses this by introducing a check. The has_permission function now requires an is_auth_enabled boolean. If an authentication session is missing, it now returns not is_auth_enabled. This ensures that if authentication is enabled, an unauthenticated request is correctly denied access.

The primary vulnerable functions are the API endpoints listed in the advisory (getAuthorisedNames, getPermissionsForUser, hasPermission, addPermission, removePermission) located in the ThriftAuthAPIHandler class. These functions were modified in the patch to pass the necessary is_auth_enabled flag down to the permission checking logic, effectively closing the bypass.

Vulnerable functions

ThriftAuthAPIHandler.getPermissionsForUser

web/server/codechecker_server/api/authentication.py

This function was vulnerable to an authentication bypass. When called by an unauthenticated user, the underlying permission check (`permissions.has_permission`) would incorrectly grant access because it treated a missing authentication session as a sign that authentication was disabled server-wide. This allowed an attacker to list permissions without being authenticated.

ThriftAuthAPIHandler.getAuthorisedNames

web/server/codechecker_server/api/authentication.py

This function was vulnerable to an authentication bypass. When called by an unauthenticated user, the underlying permission check (`permissions.has_permission` via `require_manager`) would incorrectly grant access because it treated a missing authentication session as a sign that authentication was disabled server-wide. This allowed an attacker to get authorized names for a permission without being authenticated.

ThriftAuthAPIHandler.addPermission

web/server/codechecker_server/api/authentication.py

This function was vulnerable to an authentication bypass. When called by an unauthenticated user, the underlying permission check (`permissions.has_permission` via `require_manager`) would incorrectly grant access because it treated a missing authentication session as a sign that authentication was disabled server-wide. This allowed an attacker to add permissions for any user without being authenticated.

ThriftAuthAPIHandler.removePermission

web/server/codechecker_server/api/authentication.py

This function was vulnerable to an authentication bypass. When called by an unauthenticated user, the underlying permission check (`permissions.has_permission` via `require_manager`) would incorrectly grant access because it treated a missing authentication session as a sign that authentication was disabled server-wide. This allowed an attacker to remove permissions from any user without being authenticated.

ThriftAuthAPIHandler.hasPermission

web/server/codechecker_server/api/authentication.py

This function was vulnerable to an authentication bypass. When called by an unauthenticated user, the underlying permission check (`permissions.has_permission` via `require_permission`) would incorrectly grant access because it treated a missing authentication session as a sign that authentication was disabled server-wide. This allowed an attacker to check for permissions without being authenticated.

BasePermissionHandler.has_permission

web/server/codechecker_server/permissions.py

This function contained the root cause of the vulnerability. It incorrectly assumed that a missing `auth_session` meant that authentication was disabled on the server, and therefore granted permission by returning `True`. The fix involves passing an `is_auth_enabled` flag and returning `False` if a session is missing while authentication is enabled. While not a direct API endpoint, this function is central to the exploit.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.