What’s Vulnerable › Vulnerabilities

CVE-2026-49949: CodexBar < 0.33.0 Credential Leakage via HTTP Redirect

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-11 · updated 2026-10-26
• Weakness: CWE-522

Description

CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent attackers to intercept sensitive credentials by issuing cross-origin or HTTP-downgrade redirects to the shared ProviderHTTPClient transport. Attackers can redirect credentialed provider requests carrying browser cookies, bearer tokens, or API keys to an unintended host, port, or plaintext HTTP destination to capture those credentials.

Affected products

• steipete CodexBar: before 0.33.0 — fixed in 0.33.0

How to fix

Upgrade to a fixed version: steipete CodexBar 0.33.0. Check the vendor advisory for mitigations.

References

• https://github.com/steipete/CodexBar/commit/08c171b6b487654a0eb188494fa24bd1c4272a2e
• https://github.com/steipete/CodexBar/pull/1237
• https://github.com/steipete/CodexBar/releases/tag/v0.33.0
• https://www.vulncheck.com/advisories/codexbar-credential-leakage-via-http-redirect

Get alerted when CVE-2026-49949 or the next vulnerability affects your stack