Read the docs
TI-2026-85815 Aliases CVE-2026-84155

Session tokens stay valid after logout in CodeChecker

Priority LOW 23CWE-613Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-613.

Summary

Ericsson CodeChecker before 6.29.3 does not fully invalidate a session token on logout when the web server runs more than one API worker process, which is the default. Logout clears only the in-memory session cache of the worker that handles the request, so other workers keep accepting the token until the session expires (CWE-613). An attacker who has captured a valid token can keep impersonating the user after the user logs out.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

CodeChecker's web server fails to fully invalidate a session token on logout when the server runs with more than one API worker process (the default). Each worker process maintains its own in-memory session cache; logout only clears the cache of the single worker that handles the request (plus the shared database record). Other workers continue to honor the destroyed token from their stale in-memory copies until the session's lifetime expires. An attacker who has captured a valid token can therefore keep impersonating the user after the user has logged out.

Why it matters now

EPSS 0.00139 3rd percentileScored 2026-11-07
Fix Fixed CodeChecker (Ericsson): 6.29.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
EricssonCodeCheckerbefore 6.29.36.29.3Patch availableCNA
  • CodeChecker VendorEricsson Affected before 6.29.3 Fixed in 6.29.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:ericsson:codechecker:*:*:*:*:*:*:*:*——Ericsson
  • cpe:2.3:a:ericsson:codechecker:*:*:*:*:*:*:*:* Versions — — ·Ericsson

Remediation

Upgrade Ericsson CodeChecker to version 6.29.3 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA CodeChecker (Ericsson) Fixed in 6.29.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Ericsson CodeChecker 6.29.3

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-85880 Unbounded zlib decompression in CodeChecker enables denial of servicePriority LOW 22
    • TI-2026-85879 Stored cross-site scripting in CodeChecker HTML report exportPriority LOW 3
    Show all 3 records →

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-84155

References

Other 1

  • TI-2024-09344 Authentication bypass in Ericsson CodeChecker CVSS 3.1CRITICAL 10.0
  • TI-2024-36027 Cross-Site Request Forgery in CodeChecker API CVSS 3.1HIGH 8.2
  • TI-2025-27277 Buffer overflow in CodeChecker log command CVSS 3.1HIGH 7.8
  • TI-2023-27200 Path traversal in `CodeChecker server` in the endpoint of `CodeChecker store` CVSS 3.1MEDIUM 6.5
  • TI-2026-41851 Authenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun CVSS 4.0MEDIUM 5.5
  • TI-2021-19324 In Ericsson Network Location before 2021-07-31, it is possible for an authenticated… CVSS 3.1HIGH 8.8
See all 60 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences