CVE-2026-25660 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-25660 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-25660 is a critical authentication bypass vulnerability affecting Ericsson CodeChecker, an analyzer tooling, defect database, and viewer extension built around Clang Static Analyzer and Clang Tidy.

Technical Detail

The flaw allows an unauthenticated attacker to bypass authentication controls by crafting a URL that terminates with specific characters or strings that the authentication logic fails to properly validate, effectively circumventing access enforcement. The incomplete CVE description suggests the bypass is tied to how the application parses or matches URL patterns during the authentication check, allowing requests that should require credentials to be processed without them. Successful exploitation grants unauthorized access to CodeChecker's defect database and analysis results, which may expose sensitive source code analysis data, internal vulnerability findings, and potentially allow manipulation of stored defect records.

Exploitation Status

No known exploit code has been publicly observed or confirmed at this time. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Despite the absence of confirmed exploitation, the critical CVSS score of 9.8 and the nature of the flaw make it a high-priority patching target, as authentication bypass vulnerabilities of this class are typically straightforward to weaponize once the bypass condition is understood.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability as of the date of this briefing.

What To Do

Organizations running Ericsson CodeChecker should apply the vendor-supplied patch immediately given the critical severity rating and the ease with which authentication bypass vulnerabilities can be exploited. If patching cannot be performed immediately, restrict network access to the CodeChecker instance to trusted internal networks or VPN-only access, and disable public-facing exposure of the service. Review access logs for anomalous unauthenticated requests, particularly those targeting authentication-adjacent endpoints with unusual URL suffixes. Monitor the Ericsson and CodeChecker GitHub advisory channels for updated guidance and confirmed patch versions.