CVE-2024-10082

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user up until 6.24.1 is generated in a weak manner, cannot be disabled, and has universal access.This vulnerability allows an attacker who can create an account on an enabled external authentication service, to log in as the root user, and access and control everything that can be controlled via the web interface. The attacker needs to acquire the username of the root user to be successful. This issue affects CodeChecker: through 6.24.1.

• CWE-305
• CWE-330
• CWE-842

• https://github.com/Ericsson/codechecker/security/advisories/GHSA-fpm5-2wcj-vfr7Vendor Advisory

Published

Nov 6, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-10076The Jetpack WordPress plugin before 13.8, Jetpack Boost Wo…5.9
• CVE-2024-10078The WP Easy Post Types plugin for WordPress is vulnerable to…6.3
• CVE-2024-10079The WP Easy Post Types plugin for WordPress is vulnerable to…8.8
• CVE-2024-1008A vulnerability was found in SourceCodester Employee Managem…7.2
• CVE-2024-10080The WP Easy Post Types plugin for WordPress is vulnerable to…5.4
• CVE-2024-10081CodeChecker is an analyzer tooling, defect database and view…10
• CVE-2024-10083CWE-20: Improper Input Validation vulnerability exists that …6.8
• CVE-2024-10084The Contact Form 7 – Dynamic Text Extension plugin for WordP…4.3
• CVE-2024-10086A vulnerability was identified in Consul and Consul Enterpri…6.1
• CVE-2024-10087Internet Starter, one of SoftCOM iKSORIS system modules, is …5.4
• CVE-2024-10088Internet Starter, one of SoftCOM iKSORIS system modules, is …6.1
• CVE-2024-10089Internet Starter, one of SoftCOM iKSORIS system modules, is …5.4