CVE-2026-55403CWE-200CWE-601
datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas
Low · published July 28, 2026
What it is
datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped to one schema host to be leaked to another redirect target. This issue is fixed in version 0.63.0.
The record
Technical detail
- CVSS v3.1
- 3.7 · LOW
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00336 · 25.8th percentile
- Weaknesses
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
- Published
- 2026-07-28T21:31Z
EPSS history
Timeline