Cross-Origin Credential Leakage in datamodel-code-generator by Koxudaxi

CVE-2026-55403

What is CVE-2026-55403?

The datamodel-code-generator tool, which generates Python data models from schema definitions, has a vulnerability that can lead to the leakage of sensitive credentials such as Authorization, Cookie, and Proxy-Authorization headers. When fetching remote schemas, if the tool follows cross-origin redirects, it can inadvertently expose credentials scoped to one schema host to another redirect target. This issue has been resolved in version 0.63.0 of the tool.

References