---
id: CVE-2026-49949
title: CodexBar < 0.33.0 Credential Leakage via HTTP Redirect
summary: >-
  CodexBar before 0.33.0 contains a credential forwarding vulnerability that
  allows network-adjacent attackers to intercept sensitive credentials by
  issuing cross-origin or HTTP-downgrade redirects to the shared
  ProviderHTTPClient transpor…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-522
vendor: steipete
product: CodexBar
affected:
  - CodexBar < 0.33.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-12T13:52:52.351449Z'
published: '2026-06-11'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:04:55.844Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-49949'
references:
  - url: 'https://github.com/steipete/CodexBar/releases/tag/v0.33.0'
    label: CodexBar 0.33.0 Release Notes
  - url: 'https://github.com/steipete/CodexBar/pull/1237'
  - url: >-
      https://github.com/steipete/CodexBar/commit/08c171b6b487654a0eb188494fa24bd1c4272a2e
  - url: >-
      https://www.vulncheck.com/advisories/codexbar-credential-leakage-via-http-redirect
tags:
  - cve.org
epss: 0.00253
epssPercentile: 0.1692
ingestedAt: '2026-11-08T14:51:22.384Z'
---

## Overview

CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent attackers to intercept sensitive credentials by issuing cross-origin or HTTP-downgrade redirects to the shared ProviderHTTPClient transport. Attackers can redirect credentialed provider requests carrying browser cookies, bearer tokens, or API keys to an unintended host, port, or plaintext HTTP destination to capture those credentials.

## Affected

- `CodexBar < 0.33.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.