CVE-2026-43625: CodexBar < 0.32.0 Session Cookie Exposure via HTTP Redirect

Synopsis

Session cookie leakage in CodexBar (versions before 0.32.0) allows a network-positioned attacker to intercept cleartext HTTP requests that carry imported browser session cookies. The flaw stems from improper redirect handling for Amp and Ollama provider sessions, where a provider-controlled redirect can route session cookies over unencrypted HTTP. No authentication is needed to exploit this; a successful attacker reads the victim's session cookies in transit, which can be replayed to hijack authenticated sessions. A patched-image rebuild at version 0.32.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be positioned on the network path between the client and the provider endpoint to intercept the cleartext HTTP request carrying session cookies.

• AuthenticationNot required

  No account or credential of any privilege level is needed; the attacker passively intercepts traffic on the network path.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is required; the interception occurs transparently during normal session activity.

• Attack complexityDetail

  While the exploit itself is straightforward once positioned, the attacker requires a specific network precondition (being on the network path during a redirect), which CVSS AT:P reflects as an attack requirement rather than a free-standing complexity barrier.

Blast Radius

• Reads imported browser session cookies for Amp and Ollama provider sessions as they traverse the network in cleartext.
• Replays captured session cookies to authenticate as the victim user against the affected provider, gaining full session-level access.
• Leaves confidentiality of stored data and service integrity intact at the server side, but session hijacking gives the attacker the same access rights the victim holds.