Vulnerability in Steipete Codexbar
CVE-2026-43625
CodexBar prior to 0.32.0 contains a session cookie leakage vulnerability that allows network attackers to intercept imported browser session cookies by exploiting improper redirect handling for Amp and Ollama provider sessions. Attackers can position themselves on the network path to receive cleartext HTTP requests carrying imported session cookies when a provider-controlled redirect target issues a redirect to a cleartext HTTP endpoint within the same provider domain.
EPSS: 0.002 (8.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Steipete Codexbar — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (release-notes)
- disclosure@vulncheck.com (issue-tracking)
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-43625?
- CVE-2026-43625 is a medium-severity vulnerability in Steipete Codexbar, classified under Cleartext Transmission of Sensitive Information. CVSS score: 5.9/10. Published 2026-06-01.
- How severe is CVE-2026-43625?
- Medium severity. CVSS v3 base score is 5.9 out of 10.