Dashboard / CVE-2026-43625

CVE-2026-43625

HIGH
MEDIUM Priority: 0.02 BB Relevance: 76/100
Published: 2026-06-01 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
AT: Present
VC: High
VI: None
VA: None

Description

CodexBar prior to 0.32.0 contains a session cookie leakage vulnerability that allows network attackers to intercept imported browser session cookies by exploiting improper redirect handling for Amp and Ollama provider sessions. Attackers can position themselves on the network path to receive cleartext HTTP requests carrying imported session cookies when a provider-controlled redirect target issues a redirect to a cleartext HTTP endpoint within the same provider domain.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
steipete CodexBar 0 < 0.32.0

References & Advisories (4)

Bug Bounty Relevance

76 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

8.2 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.19%
Raw Score 0.001860
Percentile 8.3%
Date 2026-11-08

Intelligence Sources

mitre ref →

External Links