CVE-2026-55403 – datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas

CVE ID :CVE-2026-55403

Published : July 28, 2026, 10:17 p.m. | 22 minutes ago

Description :datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped to one schema host to be leaked to another redirect target. This issue is fixed in version 0.63.0.

Severity: 3.7 | LOW

Visit the link for more details, such as CVSS details, affected products, timeline, and more…