CVE-2024-10081

Ericsson CodeChecker, an analyzer tooling and defect database/viewer for Clang Static Analyzer and Clang Tidy, contains a critical authentication bypass (CWE-288/CWE-420) in all versions through 6.24.1. The flaw is triggered when an API request URL ends with 'Authentication', causing the server to skip authentication checks. An unauthenticated remote attacker can then obtain superuser access to all API endpoints except /Authentication itself, allowing them to add, edit, and remove products and otherwise administer the defect database. Any CodeChecker deployment running an affected version is exposed, with the greatest risk for instances reachable from the internet or shared networks. No public proof-of-concept is known and the flaw is not in CISA's KEV, but EPSS assigns a 39.1% probability of exploitation within 30 days (99th percentile), indicating elevated near-term risk.

What to do: Upgrade to a CodeChecker release newer than 6.24.1, as the advisory lists every version through 6.24.1 as affected. Until patched, restrict network access to the CodeChecker web/API endpoint (VPN, firewall rules, or an authenticating reverse proxy) to limit unauthenticated access. Review server logs for API requests whose URL ends with 'Authentication', which would indicate attempted or successful exploitation.