VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Jun 11, 2026· Updated Jun 11, 2026

CVE-2026-49949

CVE-2026-49949

Description

CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent attackers to intercept sensitive credentials by issuing cross-origin or HTTP-downgrade redirects to the shared ProviderHTTPClient transport. Attackers can redirect credentialed provider requests carrying browser cookies, bearer tokens, or API keys to an unintended host, port, or plaintext HTTP destination to capture those credentials.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • CodexBar/Codexbarreferences2 versions
    (expand)+ 1 more
    • (no CPE)
    • (no CPE)range: <0.33.0

Patches

Vulnerability mechanics

References

4

News mentions

1