CVE-2026-49949
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A credential forwarding vulnerability in CodexBar before 0.33.0 allows network-adjacent attackers to intercept sensitive credentials via cross-origin or HTTP-downgrade redirects. Attackers can redirect credentialed requests carrying cookies, bearer tokens, or API keys to an unintended host, port, or plaintext HTTP destination.
Risk Assessment
The organization risks theft of sensitive user credentials, potentially leading to unauthorized access to systems and data.
Recommendation
Immediately update CodexBar to version 0.33.0 or later, which fixes this vulnerability.
Other vulnerabilities in CodexBar
See all- CVE-2026-49135High
CodexBar before version 0.32.0 contains an insecure temporary file handling vulnerability. A local attacker can read the App Store Connect API key written to a fixed path, create symbolic links at predictable locations to redirect writes, or tamper with notarization archives before submission.
- CVE-2026-49134High
CodexBar before version 0.32.0 contains a privilege escalation vulnerability in the CLI installer, allowing local attackers to execute arbitrary commands as root by exploiting a race condition in temporary file handling. The installer creates a temporary file with mktemp, writes a privileged shell payload into it, and executes it with administrator privileges, allowing a local process to overwrite the installer body before the administrator prompt is approved.
- CVE-2026-43625Medium
CodexBar before version 0.32.0 contains a session cookie leakage vulnerability, allowing network attackers to intercept imported browser session cookies via improper redirect handling for Amp and Ollama provider sessions.
Original NVD description (English source)
CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent attackers to intercept sensitive credentials by issuing cross-origin or HTTP-downgrade redirects to the shared ProviderHTTPClient transport. Attackers can redirect credentialed provider requests carrying browser cookies, bearer tokens, or API keys to an unintended host, port, or plaintext HTTP destination to capture those credentials.