CVE-2026-49949 describes a vulnerability in steipete's CodexBar before version 0.33.0. The issue involves insufficient protection of credentials during HTTP requests handled by the shared ProviderHTTPClient transport. Network-adjacent attackers can exploit cross-origin or HTTP downgrade redirects to redirect credentialed provider requests to unintended hosts, ports, or plaintext HTTP destinations. This redirection enables attackers to intercept sensitive credentials including browser cookies, bearer tokens, or API keys. The CVSS 4.0 base score is 6.0, indicating a medium severity vulnerability with network attack vector, high complexity, no privileges required, and user interaction needed.

An attacker positioned on the network adjacent to a vulnerable CodexBar client can intercept sensitive credentials by redirecting credentialed requests to unintended destinations. This can lead to credential disclosure including cookies, bearer tokens, and API keys, potentially compromising user sessions or API access. The vulnerability does not require privileges or attacker authentication but does require user interaction and has high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated, users should monitor the vendor's communications for updates. Until a fix is available, avoid using versions prior to 0.33.0 in environments where network-adjacent attackers could intercept traffic. Consider network-level protections to prevent HTTP downgrade or cross-origin redirects if feasible.