CVE-2026-55403CWE-200CWE-601

datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas

Low · published July 28, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
25.8
In the wild
Unconfirmed
What it is

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped to one schema host to be leaked to another redirect target. This issue is fixed in version 0.63.0.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00336 · 25.8th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-07-28T21:31Z
EPSS history
Timeline
  • 28 JUL 21:31Z
    datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas
    cvelistv5