Credential Exposure in Electron Apps Due to Improper Header Handling

CVE-2026-54673

What is CVE-2026-54673?

The electron-updater component, which facilitates automatic updates for Electron applications, contains a flaw that exposes sensitive credentials during HTTP redirect handling. Prior to version 9.7.0, the implementation inadequately manages authorization headers, allowing not only the standard 'authorization' header to be stripped but failing to handle others like 'PRIVATE-TOKEN' and mixed-case 'Authorization'. This could potentially allow attackers to gain access to user credentials through malicious cross-origin redirects, underscoring the need for users to update to the latest version to secure their applications.

References