CVE-2026-55403 Details
Description
datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped to one schema host to be leaked to another redirect target. This issue is fixed in version 0.63.0.
A vulnerability in datamodel-code-generator prior to version 0.63.0 allows for the leakage of sensitive headers, such as Authorization, Cookie, and Proxy-Authorization, during cross-origin HTTP redirects while fetching remote schemas. This issue arises because the tool reuses these headers without validating the origin change, potentially exposing credentials to an unauthorized target.
Users can update to datamodel-code-generator version 0.63.0 or later, where this vulnerability has been fixed. The update removes Authorization, Cookie, and Proxy-Authorization headers when a redirect crosses origins, preventing the leakage of scoped credentials.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 28, 2026CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-r5vv-ff45-prp2 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/koxudaxi/datamodel-code-generator/commit/a585c037c8307b7aae815de193b7fe1c4c44994b | [email protected] | Source CodeVendor |
| https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.63.0 | [email protected] | Release NotesVendor |
| https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-r5vv-ff45-prp2 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| koxudaxi datamodel-code-generator | <= 0.62.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |