CVE-2026-43625
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
CodexBar before version 0.32.0 contains a session cookie leakage vulnerability, allowing network attackers to intercept imported browser session cookies via improper redirect handling for Amp and Ollama provider sessions.
Risk Assessment
The risk involves potential session hijacking and unauthorized access to user accounts.
Recommendation
Update to version 0.32.0 or later and enforce HTTPS for all connections.
Other vulnerabilities in CodexBar
See all- CVE-2026-49949Medium
A credential forwarding vulnerability in CodexBar before 0.33.0 allows network-adjacent attackers to intercept sensitive credentials via cross-origin or HTTP-downgrade redirects. Attackers can redirect credentialed requests carrying cookies, bearer tokens, or API keys to an unintended host, port, or plaintext HTTP destination.
- CVE-2026-49135High
CodexBar before version 0.32.0 contains an insecure temporary file handling vulnerability. A local attacker can read the App Store Connect API key written to a fixed path, create symbolic links at predictable locations to redirect writes, or tamper with notarization archives before submission.
- CVE-2026-49134High
CodexBar before version 0.32.0 contains a privilege escalation vulnerability in the CLI installer, allowing local attackers to execute arbitrary commands as root by exploiting a race condition in temporary file handling. The installer creates a temporary file with mktemp, writes a privileged shell payload into it, and executes it with administrator privileges, allowing a local process to overwrite the installer body before the administrator prompt is approved.
Original NVD description (English source)
CodexBar prior to 0.32.0 contains a session cookie leakage vulnerability that allows network attackers to intercept imported browser session cookies by exploiting improper redirect handling for Amp and Ollama provider sessions. Attackers can position themselves on the network path to receive cleartext HTTP requests carrying imported session cookies when a provider-controlled redirect target issues a redirect to a cleartext HTTP endpoint within the same provider domain.