CVE-2024-10081
codechecker vulnerable to authentication bypass when using specifically crafted URLs
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. All endpoints, apart from the /Authentication is affected by the vulnerability.
This issue affects CodeChecker: through 6.24.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. All endpoints, apart from the /Authentication is affected by the vulnerability.
This issue affects CodeChecker: through 6.24.1.
- Record
CVE-2024-10081- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-288, CWE-420
- Updated
- 2026-11-02
EUVDEUVD-2024-3242
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. All endpoints, apart from the /Authentication is affected by the vulnerability.
This issue affects CodeChecker: through 6.24.1.
- Record
EUVD-2024-3242- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f3f8-vx3w-hp5q
codechecker vulnerable to authentication bypass when using specifically crafted URLs
Summary
Authentication bypass occurs when the API URL ends with Authentication, Configuration or ServerInfo. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others.
Details
All endpoints, apart from the /Authentication is affected by the vulnerability.
The vulnerability allows unauthenticated users to access all API functionality. You can look for the following pattern in the logs to check if the vulnerabilty was exploited:
Note that the url starts with v and contains a valid CodeChecker endpoint, but it ends in Authentication, Configuration or ServerInfo and it was made by an Anonymous user.
Impact
This authentication bypass allows querying, adding, changing, and deleting Products contained on the CodeChecker server, without authentication, by an anonymous user.
- Record
GHSA-f3f8-vx3w-hp5q- CVSS 4.0
- 9.9 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N - CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-288
- Updated
- 2026-11-02
NVD
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. All endpoints, apart from the /Authentication is affected by the vulnerability.
This issue affects CodeChecker: through 6.24.1.
- Record
CVE-2024-10081- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-288, CWE-420
- Updated
- 2026-11-02
OSV
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. All endpoints, apart from the /Authentication is affected by the vulnerability.
This issue affects CodeChecker: through 6.24.1.
- Record
CVE-2024-10081- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-288, CWE-420
- Updated
- 2026-11-02
OSVGHSA-f3f8-vx3w-hp5q
codechecker vulnerable to authentication bypass when using specifically crafted URLs
Summary
Authentication bypass occurs when the API URL ends with Authentication, Configuration or ServerInfo. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others.
Details
All endpoints, apart from the /Authentication is affected by the vulnerability.
The vulnerability allows unauthenticated users to access all API functionality. You can look for the following pattern in the logs to check if the vulnerabilty was exploited:
Note that the url starts with v and contains a valid CodeChecker endpoint, but it ends in Authentication, Configuration or ServerInfo and it was made by an Anonymous user.
Impact
This authentication bypass allows querying, adding, changing, and deleting Products contained on the CodeChecker server, without authentication, by an anonymous user.
- Record
GHSA-f3f8-vx3w-hp5q- CVSS 4.0
- 9.9 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N - CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-288
- Updated
- 2026-11-02
OSVPYSEC-2024-238 No score
CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the API URL ends with Authentication. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. All endpoints, apart from the /Authentication is affected by the vulnerability.
This issue affects CodeChecker: through 6.24.1.
- Record
PYSEC-2024-238- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
codecheckerPyPI |
before 6.24.2 | 6.24.2 |
codecheckerPyPI |
before 6.24.2, plus listed versions 6.16.06.16.0a16.17.06.18.06.18.1 Show 17 moreShow less6.18.26.19.06.19.16.20.06.20.0rc16.21.06.21.0rc16.22.06.22.0rc16.22.16.22.26.22.2.post16.23.06.23.0rc26.23.16.24.06.24.1 |
6.24.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | CodeChecker <= 6.24.1 - Authentication Bypass |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-10081 is a critical vulnerability (CVSS 10.0) in Ericsson Codechecker, published November 6, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 39.9%, the 98th percentile. Fixed in codechecker 6.24.2.
References
github.com/Ericsson/codechecker/security/advisories/GHSA-f3f8-vx3w-hp5q
nvd.nist.gov/vuln/detail/CVE-2024-10081