CodexBar versions earlier than 0.32.0 permit the disclosure of user session cookies. When a session is imported from Amp or Ollama, the application does not validate the security of the redirect target and can redirect to a clear‑text HTTP endpoint in the same provider domain. The vulnerable redirect causes an attacker who can observe or modify the network traffic to capture the clear‑text session cookie sent in the HTTP request, thereby enabling unauthorized access to the victim’s session.

The vulnerability affects all releases of steipete:CodexBar before 0.32.0. Users who rely on Amp or Ollama provider sessions are at risk, as the redirection mechanism used to establish these sessions can expose the session cookie.

The CVSS score of 8.2 indicates a high severity, and the lack of an EPSS value means the exploitation likelihood is unknown but could be significant for a determined network attacker. This flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to position themselves on the network path to observe or modify HTTP traffic that includes the redirect to a clear‑text endpoint. The attack vector is therefore a network‐based compromise rather than a local or remote code execution vector. If the attacker can observe the traffic, they can extract the session cookie, which can be replayed to gain unauthorized access to the user’s session without authentication.