Description
datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped to one schema host to be leaked to another redirect target. This issue is fixed in version 0.63.0.
Published: 2026-07-28
Score: 3.7 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-r5vv-ff45-prp2 datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas
History

Wed, 29 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 28 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Koxudaxi
Koxudaxi datamodel-code-generator
Vendors & Products Koxudaxi
Koxudaxi datamodel-code-generator

Tue, 28 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped to one schema host to be leaked to another redirect target. This issue is fixed in version 0.63.0.
Title datamodel-code-generator: Authorization / request headers leaked to cross-origin redirect target when fetching remote schemas
Weaknesses CWE-200
CWE-601
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Koxudaxi Datamodel-code-generator
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-29T12:46:11.346Z

Reserved: 2026-06-16T21:48:43.124Z

Link: CVE-2026-55403

cve-icon Vulnrichment

Updated: 2026-07-29T12:46:07.971Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-28T23:30:03Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-601

    URL Redirection to Untrusted Site ('Open Redirect')