Which versions of CodexBar are affected by CVE-2026-43625?

CodexBar, a macOS menu bar client for AI provider integration, contains a session credential exposure vulnerability (CVSS 8.2) allowing network-positioned attackers to steal authentication cookies…. A patch is available.

How to fix or mitigate CVE-2026-43625?

Within 24 hours: Identify all macOS endpoints with CodexBar installed and document systems with Amp or Ollama provider integrations. Within 7 days: Deploy CodexBar version 0.32.0 to all affected systems using standard MDM or software deployment channels; verify installation completion across the fleet. Within 30 days: Review API audit logs for Amp and Ollama providers to identify suspicious access patterns during the vulnerability exposure window; rotate API credentials and authentication tokens as a precautionary measure.

CodexBar CVE-2026-43625

Q: What is the CVSS score of CVE-2026-43625?

CVE-2026-43625 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33748 HIGH

Cleartext Transmission of Sensitive Information (CWE-319)

2026-06-01 VulnCheck

GHSA-x92v-hcjq-jcx7

Information Disclosure Codexbar Steipete

8.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 01, 2026 - 19:35 vuln.today

Analysis Generated

Jun 01, 2026 - 19:35 vuln.today

Severity Changed

Jun 01, 2026 - 19:22 NVD

MEDIUM HIGH

CVSS changed

Jun 01, 2026 - 19:22 NVD

5.9 (MEDIUM) 8.2 (HIGH)

DescriptionCVE.org

CodexBar prior to 0.32.0 contains a session cookie leakage vulnerability that allows network attackers to intercept imported browser session cookies by exploiting improper redirect handling for Amp and Ollama provider sessions. Attackers can position themselves on the network path to receive cleartext HTTP requests carrying imported session cookies when a provider-controlled redirect target issues a redirect to a cleartext HTTP endpoint within the same provider domain.

AnalysisAI

Cleartext session cookie exposure in CodexBar (a macOS menu bar AI provider client) prior to 0.32.0 allows network-positioned attackers to intercept imported browser session cookies for Amp and Ollama providers. The client failed to enforce HTTPS before reattaching imported cookies when a provider-controlled redirect pointed to a cleartext HTTP endpoint inside the same provider domain, leaking authentication material in plaintext. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

CodexBar is a macOS menu bar utility (CPE cpe:2.3:a:steipete:codexbar) that aggregates status and usage data from multiple AI/code providers, importing browser session cookies to authenticate against those providers' web endpoints. The root cause is CWE-319 (Cleartext Transmission of Sensitive Information): when a provider issued an HTTP 3xx response pointing to an http:// URL within the same provider domain, the client reattached the imported session cookies and followed the redirect without enforcing a TLS scheme check. The fix in PR #1226 / commit cdd7e34 explicitly requires the redirect target scheme to be HTTPS before reattaching cookies on Amp and Ollama provider redirects.

RemediationAI

Vendor-released patch: CodexBar 0.32.0 - upgrade immediately via the release at https://github.com/steipete/CodexBar/releases/tag/v0.32.0 (fix is PR #1226, commit cdd7e347c1cf616615f18aa2ac52ba2ec9cab332). Until upgraded, do not run vulnerable CodexBar builds on untrusted networks (hostile Wi-Fi, captive portals, shared hotel/conference networks) where an AitM can downgrade redirects, and consider disabling the Amp and Ollama provider integrations in CodexBar's Providers pane so imported cookies for those providers are not held in the client; trade-off is loss of status and usage data for those providers. Rotating Amp and Ollama browser sessions after upgrade is advisable because cookies that may have already been leaked remain valid until invalidated provider-side.