Authentication bypass occurs when a specific API endpoint URL ends with "Authentication" and allows an attacker to assign arbitrary permissions to any user in CodeChecker. This flaw represents improper authentication (CWE‑290) and the incorrect assignment of capabilities to the wrong principal (CWE‑863). The impact is a full privilege escalation within the CodeChecker environment, giving the attacker administrative or elevated rights over the defect database and potentially exposing internal defects or configuration data.

The affected vendor is Ericsson and the product is CodeChecker. All installations up to version 6.27.3 are vulnerable. Assets running this version or earlier are at risk if the authentication bypass remains unpatched.

The CVSS score of 9.3 classifies this as a critical vulnerability. The EPSS score of <1% indicates that as of the last assessment the probability of exploitation is low, and the vulnerability is not currently listed in the CISA KEV catalog. Nevertheless, the likely attack vector is remote access to the exposed HTTP API endpoints, which an attacker can leverage from any network location that has API connectivity. The attack does not require elevated privileges beyond a regular user, enabling widespread use if the system is exposed.