Vulnerability · Published Jun 11, 2026 · Assigned by VulnCheck

CVE-2026-49949CodexBar < 0.33.0 Credential Leakage via HTTP Redirect

Medium 5.3

In plain English

A medium-severity security flaw in CodexBar from steipete. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 83.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent attackers to intercept sensitive credentials by issuing cross-origin or HTTP-downgrade redirects to the shared ProviderHTTPClient transport. Attackers can redirect credentialed provider requests carrying browser cookies, bearer tokens, or API keys to an unintended host, port, or plaintext HTTP destination to capture those credentials.

Affected products (as reported)

Vendor	Product	Versions
steipete	CodexBar	0 – before 0.33.0

Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

References

https://github.com/steipete/CodexBar/releases/tag/v0.33.0 release-notes
https://github.com/steipete/CodexBar/pull/1237 issue-tracking
https://github.com/steipete/CodexBar/commit/08c171b6b487654a0eb188494fa24bd1c4272a2e patch
https://www.vulncheck.com/advisories/codexbar-credential-leakage-via-http-redirect third-party-advisory