CodexBar CVE-2026-43625

Attacker must hold an adversary-in-the-middle position on the network path between the victim's macOS host running CodexBar < 0.32.0 and the Amp or Ollama provider endpoint (e.g., shared/hostile Wi-Fi, compromised router, or control over a redirect target inside the provider domain). The victim must have imported browser session cookies for an affected provider (Amp or Ollama) into CodexBar, and the provider must issue - or be coerced into issuing - an HTTP 3xx redirect pointing to a cleartext http:// URL within the same provider domain so the client reattaches cookies on the cleartext leg. Exploitation is limited to those two provider integrations; other CodexBar providers and deployments that never traverse a hostile network segment are not exposed. No user interaction beyond normal app usage is required (UI:N), and no authentication to CodexBar itself is required (PR:N), but AT:P captures the requirement for the in-path position plus the cleartext redirect condition.

CVSS 4.0 vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N scores 8.2 and reflects a network-reachable, unauthenticated, no-user-interaction confidentiality-only impact, but with AT:P indicating special attack requirements - specifically that the attacker must be positioned on the network path between the victim and the provider AND that a provider redirect into a cleartext HTTP target must occur. EPSS, KEV, and POC status are not provided in the source data; the CVE is not in CISA KEV and no public exploit identified at time of analysis, which lowers urgency relative to the raw 8.2. The realistic risk is moderate: exploitation requires an adversary-in-the-middle position (hostile Wi-Fi, compromised upstream network, or attacker control over a redirect target inside the provider domain), so this is a targeted-opportunity bug rather than a mass-exploitable one, but the captured material is a live provider session cookie with high reuse value.

A user on a coffee-shop Wi-Fi launches CodexBar, which refreshes its Amp or Ollama provider status using imported browser session cookies; an attacker on the same LAN intercepts or induces a provider response that 302-redirects to an http:// URL on the provider's own domain, and CodexBar follows the redirect with the session cookie attached in cleartext. The attacker captures the cookie off the wire and replays it to impersonate the user against the provider. No public exploit identified at time of analysis.