datamodel-code-generator constructs Python data models by retrieving schema definitions from remote locations. Until version 0.63.0 the utility re‑used the Authorization, Cookie, and Proxy-Authorization headers when following cross‑origin redirects while fetching these schemas. This behaviour exposes credentials that were scoped to the original schema host to an attacker who controls the redirect target, resulting in sensitive credential disclosure. The weakness manifests as a leakage of authentication information and is mapped to CWE‑200 and CWE‑601. The vulnerability is an information‑exposure issue; no privilege escalation or code execution is required beyond the ability to run the tool and point it at a remote schema. The CVSS base score of 3.7 reflects a low‑severity disclosure scenario, and an EPSS score of <1 % indicates a very low likelihood of exploitation. The issue is not on the CISA KEV list. Attackers would need to supply a remote schema that redirects to a host where they can capture the forwarded credentials and must have the tool execute in an environment that can reach the target.

The affected vendor is koxudaxi and its datamodel‑code‑generator package. All releases prior to version 0.63.0 contain the flaw; users of 0.62.x and earlier should check the version they are using and upgrade to 0.63.0 or later.

The CVSS score of 3.7 denotes low exposure risk, and the EPSS score of <1 % shows that real‑world exploitation is unlikely at this time. Although the issue is not listed in CISA KEV, it could still be abused by an attacker who controls the redirect target of a schema; such an attacker would need the tool to be running in an environment that can reach malicious hosts, so local access or compromised automation is required.