CVE-2026-54673
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk14th percentile — higher than 14% of all known CVEs
Summary
A vulnerability in electron-updater prior to version 9.7.0 allows credential leakage during HTTP redirects. The redirect handler only stripped the lowercase 'authorization' header, leaving other credential-bearing headers like 'PRIVATE-TOKEN' and mixed-case 'Authorization' exposed, potentially forwarding them to attacker-controlled cross-origin destinations.
Risk Assessment
An attacker can intercept personal access tokens (e.g., GitLab PAT) or Bearer/OAuth tokens by redirecting the application to a controlled server, leading to unauthorized access and data breach.
Recommendation
Immediately update electron-updater to version 9.7.0 or later, which properly strips all sensitive authentication headers during redirects.
Original NVD description (English source)
electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase "authorization", exposing credentials. Other credential-bearing headers — most notably PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization (used by GitLab's Bearer/OAuth flow) — were not stripped and could be forwarded to an attacker-controlled cross-origin redirect destination. This issue has been fixed in version 9.7.0.