Executive brief
CodexBar, a tool used for managing and monitoring AI provider usage, contains a security flaw in how it handles user sessions for Amp and Ollama services. When the application follows a web redirect, it may inadvertently send sensitive login cookies over unencrypted HTTP connections if the destination site downgrades the security of the connection. An attacker positioned on the same network (such as on public Wi-Fi) could intercept these cookies to hijack the user's AI provider accounts.
Technical details
CodexBar prior to 0.32.0 contains a cleartext transmission of sensitive information vulnerability (CWE-319) within the AmpUsageFetcher and OllamaUsageFetcher components. The root cause is improper redirect handling where the application manually reattaches imported browser session cookies to redirected requests based on host matching, but fails to verify the URI scheme. If a provider-controlled or intercepted redirect target downgrades the connection from HTTPS to HTTP while remaining within the same provider domain (e.g., ampcode.com or ollama.com), the sensitive Cookie header is transmitted in cleartext. A network-positioned attacker can intercept these requests to obtain session cookies. This issue was resolved in version 0.32.0 by requiring the HTTPS scheme before reattaching cookies during redirects.
Affected products
- steipete CodexBar < 0.32.0
Timeline
- 2026-05-30: patched: Fix merged in GitHub pull request #1226
- 2026-05-31: advisory: Version 0.32.0 released
- 2026-06-01: disclosed: CVE-2026-43625 published