Vulnerability · Published Jun 1, 2026 · Assigned by VulnCheck

CVE-2026-43625CodexBar < 0.32.0 Session Cookie Exposure via HTTP Redirect

Medium 5.9

In plain English

A medium-severity security flaw in CodexBar from steipete. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.2%top 91.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CodexBar prior to 0.32.0 contains a session cookie leakage vulnerability that allows network attackers to intercept imported browser session cookies by exploiting improper redirect handling for Amp and Ollama provider sessions. Attackers can position themselves on the network path to receive cleartext HTTP requests carrying imported session cookies when a provider-controlled redirect target issues a redirect to a cleartext HTTP endpoint within the same provider domain.

Affected products (as reported)

Vendor	Product	Versions
steipete	CodexBar	0 – before 0.32.0

Weakness: CWE-319 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/steipete/CodexBar/releases/tag/v0.32.0 release-notes
https://github.com/steipete/CodexBar/pull/1226 issue-tracking
https://github.com/steipete/CodexBar/commit/cdd7e347c1cf616615f18aa2ac52ba2ec9cab332 patch
https://www.vulncheck.com/advisories/codexbar-session-cookie-exposure-via-http-redirect third-party-advisory