steipete CodexBar up to 0.31.x HTTP Endpoint cleartext transmission

Summaryinfo

A vulnerability identified as problematic has been detected in steipete CodexBar up to 0.31.x. This vulnerability affects unknown code of the component HTTP Endpoint. The manipulation leads to cleartext transmission. This vulnerability is listed as CVE-2026-43625. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in steipete CodexBar up to 0.31.x. This issue affects some unknown functionality of the component HTTP Endpoint. The manipulation with an unknown input leads to a cleartext transmission vulnerability. Using CWE to declare the problem leads to CWE-319. The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. Impacted is confidentiality. The summary by CVE is:

CodexBar prior to 0.32.0 contains a session cookie leakage vulnerability that allows network attackers to intercept imported browser session cookies by exploiting improper redirect handling for Amp and Ollama provider sessions. Attackers can position themselves on the network path to receive cleartext HTTP requests carrying imported session cookies when a provider-controlled redirect target issues a redirect to a cleartext HTTP endpoint within the same provider domain.

The weakness was presented by Chia Min Jun Lennon. The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-43625 since 05/01/2026. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1040 for this issue.

Upgrading to version 0.32.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch cdd7e347c1cf616615f18aa2ac52ba2ec9cab332 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• steipete

Name

• CodexBar

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31

License

• open-source

Website

• Product: https://github.com/steipete/CodexBar/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion