CVE-2026-55403
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
In datamodel-code-generator prior to version 0.63.0, the get_body function reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, potentially leaking credentials to external servers. This issue has been fixed in version 0.63.0.
Risk Assessment
An attacker could capture authentication credentials (e.g., session tokens) via a redirect to a server they control.
Recommendation
Upgrade datamodel-code-generator to version 0.63.0 or later.
Original NVD description (English source)
datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodel_code_generator/http.py get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped to one schema host to be leaked to another redirect target. This issue is fixed in version 0.63.0.