CVE-2026-49949 describes a vulnerability in steipete's CodexBar prior to version 0.33.0 where insufficient protection of credentials in the ProviderHTTPClient transport allows network-adjacent attackers to intercept sensitive credentials. By leveraging cross-origin or HTTP-downgrade redirects, attackers can redirect requests carrying authentication tokens or cookies to unintended hosts or plaintext HTTP endpoints, enabling credential capture. This vulnerability affects all versions before 0.33.0 and has a CVSS 4.0 base score of 6.0, indicating medium severity. No official patch or remediation level has been provided as of the published date.

The vulnerability allows attackers who are network-adjacent to intercept sensitive authentication credentials such as browser cookies, bearer tokens, or API keys by redirecting credentialed requests to unintended or insecure destinations. This can lead to unauthorized access or credential theft. However, exploitation requires the ability to induce cross-origin or HTTP-downgrade redirects and the attacker must be positioned on the network path.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using versions of CodexBar prior to 0.33.0 in environments where network-adjacent attackers could induce redirects. Monitor vendor communications for updates on patches or official mitigations.