Is CVE-2026-43625 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-43625 being exploited in the wild.

How severe is CVE-2026-43625?

Medium severity, with a CVSS score of 5.9, published 1 June 2026.

Is there a fix for CVE-2026-43625?

A patch was published on 2026-05-30: Fix merged in GitHub pull request #1226 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-43625 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-43625?

Check whether you run Steipete CodexBar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43625: CodexBar session cookie leakage in Amp and Ollama providers

CVE-2026-43625 · Severity: medium · CVSS 5.9 · Published 2026-06-01

CodexBar, a tool used for managing and monitoring AI provider usage, contains a security flaw in how it handles user sessions for Amp and Ollama services. When the application follows a web redirect, it may inadvertently send sensitive login cookies over unencrypted HTTP connections if the destination site downgrades the security of the connection. An attacker positioned on the same network (such as on public Wi-Fi) could intercept these cookies to hijack the user's AI provider accounts.

Technologies: Steipete CodexBar. Vendors: Steipete.

Quick answers

Is CVE-2026-43625 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-43625 being exploited in the wild.
How severe is CVE-2026-43625?: Medium severity, with a CVSS score of 5.9, published 1 June 2026.
Which products and versions are affected?: Steipete CodexBar < 0.32.0.
Is there a fix for CVE-2026-43625?: A patch was published on 2026-05-30: Fix merged in GitHub pull request #1226 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43625 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-43625?: Check whether you run Steipete CodexBar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CodexBar prior to 0.32.0 contains a cleartext transmission of sensitive information vulnerability (CWE-319) within the AmpUsageFetcher and OllamaUsageFetcher components. The root cause is improper redirect handling where the application manually reattaches imported browser session cookies to redirected requests based on host matching, but fails to verify the URI scheme. If a provider-controlled or intercepted redirect target downgrades the connection from HTTPS to HTTP while remaining within the same provider domain (e.g., ampcode.com or ollama.com), the sensitive Cookie header is transmitted in cleartext. A network-positioned attacker can intercept these requests to obtain session cookies. This issue was resolved in version 0.32.0 by requiring the HTTPS scheme before reattaching cookies during redirects.

Affected products

steipete CodexBar < 0.32.0

Timeline

2026-05-30: patched: Fix merged in GitHub pull request #1226
2026-05-31: advisory: Version 0.32.0 released
2026-06-01: disclosed: CVE-2026-43625 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.