AIKIDO-2026-338559

TL;DR

When datamodel-code-generator fetches a remote schema and follows HTTP redirects manually, it re-sends the original request headers, including Authorization, Cookie, and Proxy-Authorization, even when a redirect changes origin. An operator who scopes credentials to a trusted schema host can leak them to an attacker-controlled redirect target via a compromised host or attacker-influenced $ref. The fix strips sensitive headers on cross-origin redirects while preserving them for same-origin hops.