---
id: CVE-2026-43625
title: CodexBar < 0.32.0 Session Cookie Exposure via HTTP Redirect
summary: >-
  CodexBar prior to 0.32.0 contains a session cookie leakage vulnerability that
  allows network attackers to intercept imported browser session cookies by
  exploiting improper redirect handling for Amp and Ollama provider sessions.
  Attackers…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-319
vendor: steipete
product: CodexBar
affected:
  - CodexBar < 0.32.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-01T21:19:00.631344Z'
published: '2026-06-01'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:03:26.961Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43625'
references:
  - url: 'https://github.com/steipete/CodexBar/releases/tag/v0.32.0'
    label: CodexBar 0.32.0 Release Notes
  - url: 'https://github.com/steipete/CodexBar/pull/1226'
  - url: >-
      https://github.com/steipete/CodexBar/commit/cdd7e347c1cf616615f18aa2ac52ba2ec9cab332
  - url: >-
      https://www.vulncheck.com/advisories/codexbar-session-cookie-exposure-via-http-redirect
tags:
  - cve.org
epss: 0.00186
epssPercentile: 0.08275
ingestedAt: '2026-11-08T14:51:22.430Z'
---

## Overview

CodexBar prior to 0.32.0 contains a session cookie leakage vulnerability that allows network attackers to intercept imported browser session cookies by exploiting improper redirect handling for Amp and Ollama provider sessions. Attackers can position themselves on the network path to receive cleartext HTTP requests carrying imported session cookies when a provider-controlled redirect target issues a redirect to a cleartext HTTP endpoint within the same provider domain.

## Affected

- `CodexBar < 0.32.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.