Is CVE-2026-49949 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49949 being exploited in the wild.

How severe is CVE-2026-49949?

Medium severity, with a CVSS score of 5.3, published 11 June 2026.

Which products and versions are affected?

Steipete CodexBar before 0.33.0.

Is there a fix for CVE-2026-49949?

A patch was published on 2026-06-10: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49949 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-49949?

Check whether you run Steipete CodexBar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49949: CodexBar credential forwarding via cross-origin redirects

CVE-2026-49949 · Severity: medium · CVSS 5.3 · Published 2026-06-11

CodexBar, a tool used for managing AI provider integrations and costs, was found to have a security flaw in how it handles network requests. An attacker could potentially trick the application into sending sensitive information, such as login cookies or API keys, to a server they control. This could lead to the theft of user credentials or unauthorized access to AI services like OpenAI.

Technologies: Steipete CodexBar. Vendors: Steipete.

Quick answers

Is CVE-2026-49949 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49949 being exploited in the wild.
How severe is CVE-2026-49949?: Medium severity, with a CVSS score of 5.3, published 11 June 2026.
Which products and versions are affected?: Steipete CodexBar before 0.33.0.
Is there a fix for CVE-2026-49949?: A patch was published on 2026-06-10: Fix merged into main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49949 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-49949?: Check whether you run Steipete CodexBar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A credential forwarding vulnerability exists in CodexBar's ProviderHTTPClient transport before version 0.33.0. The shared production client used default URLSession redirect handling, which failed to strip sensitive headers (cookies, bearer tokens, API keys) when following redirects to different origins or downgraded HTTP destinations. An attacker capable of influencing the destination of a provider request (e.g., via a man-in-the-middle or a compromised provider endpoint) could redirect the authenticated request to an attacker-controlled host to capture credentials. The fix, implemented in version 0.33.0, introduces a redirect guard that blocks redirects leaving the original HTTPS origin while preserving same-origin redirects.

Affected products

steipete CodexBar before 0.33.0

Timeline

2026-05-31: disclosed: Initial pull request submitted by researcher
2026-06-10: patched: Fix merged into main branch
2026-06-11: advisory: CVE published and version 0.33.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.