CodeChecker CVE-2026-25660

No special conditions-remote unauthenticated exploitation against default configurations of CodeChecker web service. Attack succeeds against any network-accessible CodeChecker instance running versions through 6.27.3 without requiring credentials, user interaction, or non-default settings. The only limiting factor is network reachability to the CodeChecker web interface (typically TCP port 8001 or custom configured port). Organizations with CodeChecker exposed to internet or accessible from untrusted internal network segments face immediate risk. The vulnerability is in core authentication logic rather than optional features, meaning all standard deployments are exploitable regardless of configuration choices.

Real-world risk is CRITICAL despite lack of confirmed active exploitation. CVSS 4.0 vector indicates worst-case scenario: network-accessible (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), with complete compromise of confidentiality, integrity, and availability across both vulnerable and subsequent systems (VC/VI/VA/SC/SI/SA all High, scope changed S:N but impact metrics maxed). SSVC framework corroborates with 'Automatable: yes' and 'Technical Impact: total', confirming this can be exploited at scale without human intervention. Proof-of-concept exists (E:P in vector) elevating immediate risk. However, SSVC 'Exploitation: none' and absence from CISA KEV suggests no widespread targeting yet. Attack surface depends on CodeChecker deployment exposure-organizations with internet-facing instances face immediate threat, while internal deployments have reduced but non-zero risk from insider threats or lateral movement scenarios. The permission assignment capability transforms this from mere authentication bypass into persistent compromise vector, as attackers can grant themselves administrative privileges for long-term access to proprietary source code analysis data.

Remote attacker crafts HTTP request with URL ending in specific authentication-related string patterns combined with permission assignment function calls, bypassing authentication checks entirely. Attacker then assigns administrator-level permissions to a controlled user account or creates new privileged accounts within CodeChecker. With elevated access, attacker exfiltrates all stored static analysis results containing proprietary source code snippets, security vulnerability findings, and development patterns, then maintains persistent access by creating backdoor accounts with administrative privileges for future reconnaissance.