Dashboard / CVE-2026-49949

CVE-2026-49949

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 62/100
Published: 2026-06-11 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: Passive
S: X
AT: None
VC: High
VI: None
VA: None

Description

CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent attackers to intercept sensitive credentials by issuing cross-origin or HTTP-downgrade redirects to the shared ProviderHTTPClient transport. Attackers can redirect credentialed provider requests carrying browser cookies, bearer tokens, or API keys to an unintended host, port, or plaintext HTTP destination to capture those credentials.

Weakness Classification (1)

References & Advisories (4)

Bug Bounty Relevance

62 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

6.0 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.25%
Raw Score 0.002530
Percentile 16.8%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00253
2026-10-28
0.00253

Intelligence Sources

nvd ref →

External Links