Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-30T22:11:37 electron-updater: electron-builder: Electron-updater: Information disclosure via unstripped credential headers during HTTP redirects 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CWE-201

electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase "authorization", exposing credentials. Other credential-bearing headers — most notably PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization (used by GitLab's Bearer/OAuth flow) — were not stripped and could be forwarded to an attacker-controlled cross-origin redirect destination. This issue has been fixed in version 9.7.0.

A flaw was found in electron-updater, a component used for automatic updates in Electron applications. This vulnerability allows a remote attacker to obtain sensitive user credentials. When an Electron application performs an HTTP redirect, the electron-updater's redirect handler fails to strip certain credential-bearing headers, such as PRIVATE-TOKEN or mixed-case Authorization headers. This oversight can lead to these credentials being forwarded to an attacker-controlled destination, resulting in information disclosure.

A flaw was found in electron-updater where credential-bearing HTTP headers (PRIVATE-TOKEN, mixed-case Authorization) are not stripped during cross-origin redirects. This could allow an attacker who controls a redirect destination to capture authentication credentials used during application update checks. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Red Hat Build of Podman Desktop Fix deferred rh-podman-desktop.git Red Hat Enterprise Linux 10 Fix deferred goose Red Hat Enterprise Linux 9 Fix deferred goose https://www.cve.org/CVERecord?id=CVE-2026-54673 https://nvd.nist.gov/vuln/detail/CVE-2026-54673 https://github.com/electron-userland/electron-builder/commit/22a7532bd01b9fb42cff7c58d599c7ad683569fe https://github.com/electron-userland/electron-builder/security/advisories/GHSA-p2f4-r6v6-j797