CVE-2026-49949
CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent attackers to intercept sensitive credenti
CVSS
5.3
Medium
EPSS
0.3%
p17
KEV
—
Exploit Today
5
0-100
Published: Jun 11, 2026 · Last modified: Jul 14, 2026 · CWE-522
0.3%EPSS · 30 days0.3%
2026-06-302026-07-20
CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent attackers to intercept sensitive credentials by issuing cross-origin or HTTP-downgrade redirects to the shared ProviderHTTPClient transport. Attackers can redirect credentialed provider requests carrying browser cookies, bearer tokens, or API keys to an unintended host, port, or plaintext HTTP destination to capture those credentials.
- github.comhttps://github.com/steipete/CodexBar/commit/08c171b6b487654a0eb188494fa24bd1c4272a2e
- github.comhttps://github.com/steipete/CodexBar/pull/1237
- github.comhttps://github.com/steipete/CodexBar/releases/tag/v0.33.0
- www.vulncheck.comhttps://www.vulncheck.com/advisories/codexbar-credential-leakage-via-http-redirect
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2022-478805.3 MED85.4%
——26An Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote, authenticated users with permissions to modify database connections to disclose a connections' cleartext password via the 'test connection' function.12dCVE-2021-342046.8 MED62.4%
——19D-Link DIR-2640-US 1.01B04 is affected by Insufficiently Protected Credentials. D-Link AC2600(DIR-2640) stores the device system account password in plain text. It does not use linux user management. In addition, the passwords of all devices are the same, and they cannot be modified by normal users. An attacker can easily log in to the target router through the serial port and obtain root privileges.12dCVE-2026-90799.8 CRI61.0%
——18libcurl had a flaw that when instructed to clear proxy authentication
credentials which made it not do so, leaving the old credentials around to get
used for subsequent transfers that should not know nor use them.14dCVE-2023-318247.5 HIG57.6%
——17An issue found in DERICIA Co. Ltd, DELICIA v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp DELICIA function.12dCVE-2023-360829.8 CRI51.7%
——16An isssue in GatesAIr Flexiva FM Transmitter/Exiter Fax 150W allows a remote attacker to gain privileges via the LDAP and SMTP credentials.12dCVE-2021-290435.9 MED50.5%
——15The Portal Store module in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 does not obfuscate the S3 store's proxy password, which allows attackers to steal the proxy password via man-in-the-middle attacks or shoulder surfing.12d