CVE-2026-54673

Received Received - Intake

Electron Updater Credential Header Exposure in HTTP Redirects

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: GitHub, Inc.

Description

electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase "authorization", exposing credentials. Other credential-bearing headers — most notably PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization (used by GitLab's Bearer/OAuth flow) — were not stripped and could be forwarded to an attacker-controlled cross-origin redirect destination. This issue has been fixed in version 9.7.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-54673

Affected Vendors & Products

Vendor	Product	Version / Range
electron-updater	electron_updater	to 9.7.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

The vulnerability exists in electron-updater versions prior to 9.7.0, specifically in the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions). It only stripped the credential header with the exact lowercase key "authorization". However, other credential-bearing headers, such as PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization headers (used by GitLab's Bearer/OAuth flow), were not stripped. This allowed these sensitive headers to be forwarded to an attacker-controlled cross-origin redirect destination, potentially exposing credentials.

This issue was fixed in version 9.7.0 of electron-updater.

Impact Analysis

This vulnerability can lead to the exposure of sensitive credentials, such as personal access tokens or OAuth tokens, to attacker-controlled servers via cross-origin redirects. An attacker could exploit this to gain unauthorized access to user accounts or services that rely on these credentials, potentially leading to data breaches or unauthorized actions within affected Electron applications.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade electron-updater to version 9.7.0 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-54673. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70