Vulnerability · Published Jul 28, 2026 · Assigned by GitHub_M

CVE-2026-55403datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas

Low 3.7

In plain English

A low-severity information exposure in datamodel-code-generator from koxudaxi. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.3%top 72.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped to one schema host to be leaked to another redirect target. This issue is fixed in version 0.63.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	datamodel-code-generator	0.63.0	GHSA-r5vv-ff45-prp2
PyPI	datamodel-code-generator	0.63.0	PYSEC-2026-3563

Affected products (as reported)

Vendor	Product	Versions
koxudaxi	datamodel-code-generator	< 0.63.0

Weakness: CWE-200, CWE-601 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-r5vv-ff45-prp2 x_refsource_CONFIRM
https://github.com/koxudaxi/datamodel-code-generator/commit/a585c037c8307b7aae815de193b7fe1c4c44994b x_refsource_MISC
https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.63.0 x_refsource_MISC