Vulnerability in Steipete Codexbar
CVE-2026-49949
CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent attackers to intercept sensitive credentials by issuing cross-origin or HTTP-downgrade redirects to the shared ProviderHTTPClient transport. Attackers can redirect credentialed provider requests carrying browser cookies, bearer tokens, or API keys to an unintended host, port, or plaintext HTTP destination to capture those credentials.
EPSS: 0.003 (16.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N.
Affected products
- Steipete Codexbar — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (issue-tracking)
- disclosure@vulncheck.com (release-notes)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-49949?
- CVE-2026-49949 is a medium-severity vulnerability in Steipete Codexbar, classified under Insufficiently Protected Credentials. CVSS score: 5.3/10. Published 2026-06-11.
- How severe is CVE-2026-49949?
- Medium severity. CVSS v3 base score is 5.3 out of 10.