# CVE-2026-55403: koxudaxi datamodel-code-generator credential leak in cross-origin redirects

Source: https://junglewise.ai/threats/cve-2026-55403-koxudaxi-datamodel-code-generator-credential-leak-in-cross-origin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-55403 · Severity: low · CVSS 3.7 · Published 2026-07-28

datamodel-code-generator is a tool used to automatically create Python code from data schema definitions. A security flaw was identified where the tool incorrectly shares sensitive login credentials (such as passwords or session tokens) when it is redirected from a trusted website to a different, potentially malicious website while downloading a schema. This could allow an attacker who controls a schema host to steal credentials intended for a legitimate service.

Technologies: [Koxudaxi Datamodel-Code-Generator](https://junglewise.ai/threats/technologies/datamodel-code-generator), [datamodel-code-generator (PyPI)](https://junglewise.ai/threats/technologies/pypi-datamodel-code-generator). Vendors: [Koxudaxi](https://junglewise.ai/threats/vendors/koxudaxi), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-55403 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55403 being exploited in the wild.

**How severe is CVE-2026-55403?** Low severity, with a CVSS score of 3.7, published 28 July 2026.

**Which products and versions are affected?** Koxudaxi Datamodel-Code-Generator <= 0.62.0; datamodel-code-generator (PyPI) ECOSYSTEM:introduced=0,fixed=0.63.0.

**Is there a fix for CVE-2026-55403?** Yes. datamodel-code-generator (PyPI): upgrade to 0.63.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55403 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55403?** Check whether you run Koxudaxi Datamodel-Code-Generator or datamodel-code-generator (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- datamodel-code-generator (PyPI): upgrade to 0.63.0 or later

  ```sh
  pip install "datamodel-code-generator>=0.63.0"
  ```


## Technical details

A credential leakage vulnerability exists in the `get_body()` function within `src/datamodel_code_generator/http.py`. The component manually handles HTTP redirects but fails to strip sensitive headers when the redirect target belongs to a different origin (scheme, host, or port). An attacker who can influence the redirect chain—either by compromising a schema host or through an open redirect—can capture `Authorization`, `Cookie`, and `Proxy-Authorization` headers. This occurs when users provide credentials via `--http-headers` or URL userinfo. The issue is resolved in version 0.63.0 by ensuring sensitive headers are dropped during cross-origin redirects.

## Affected products

- koxudaxi datamodel-code-generator <= 0.62.0

## Identifiers

- CVE-2026-55403
- GHSA-r5vv-ff45-prp2
- PYSEC-2026-3563

## Timeline

- 2026-06-11: patched: Fix merged into main branch
- 2026-06-12: advisory: GitHub Security Advisory GHSA-r5vv-ff45-prp2 published
- 2026-07-28: disclosed: CVE-2026-55403 published to NVD

## References

- [https://github.com/koxudaxi/datamodel-code-generator/commit/a585c037c8307b7aae815de193b7fe1c4c44994b](https://github.com/koxudaxi/datamodel-code-generator/commit/a585c037c8307b7aae815de193b7fe1c4c44994b)
- [https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.63.0](https://github.com/koxudaxi/datamodel-code-generator/releases/tag/0.63.0)
- [https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-r5vv-ff45-prp2](https://github.com/koxudaxi/datamodel-code-generator/security/advisories/GHSA-r5vv-ff45-prp2)

## Related threats

- [datamodel-code-generator Protobuf path traversal allows files to be written outside directory](https://junglewise.ai/threats/cve-2026-107377-datamodel-code-generator-protobuf-weak-import-path-traversal)
- [koxudaxi datamodel-code-generator code injection in generated imports](https://junglewise.ai/threats/cve-2026-55415-koxudaxi-datamodel-code-generator-code-injection-in-generated)
- [koxudaxi datamodel-code-generator SSRF via DNS rebinding](https://junglewise.ai/threats/cve-2026-55391-koxudaxi-datamodel-code-generator-ssrf-via-dns-rebinding)
- [koxudaxi datamodel-code-generator path traversal in XML Schema parsing](https://junglewise.ai/threats/cve-2026-55390-koxudaxi-datamodel-code-generator-path-traversal-in-xml-schema)
- [koxudaxi datamodel-code-generator local file read via JSON Schema ref](https://junglewise.ai/threats/cve-2026-55389-koxudaxi-datamodel-code-generator-local-file-read-via-json-schema)