CVE-2026-43625 describes a session cookie leakage vulnerability in steipete's CodexBar before version 0.32.0. The issue arises from improper handling of redirects for Amp and Ollama provider sessions, which can cause imported browser session cookies to be transmitted over cleartext HTTP. An attacker on the network path can intercept these cookies by exploiting redirects that lead to HTTP endpoints within the same provider domain, exposing sensitive session information. The vulnerability has a CVSS 4.0 base score of 8.2, indicating high severity, with network attack vector, low attack complexity, and no required privileges or user interaction.

An attacker able to intercept network traffic can obtain session cookies transmitted in cleartext, potentially allowing unauthorized access to user sessions associated with Amp and Ollama providers in CodexBar. This compromises session confidentiality and may lead to session hijacking or unauthorized actions within the affected sessions. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid using vulnerable versions of CodexBar in untrusted network environments or ensure that all redirects and session transmissions occur over secure HTTPS connections to prevent interception. Monitoring vendor communications for updates is recommended.