CVE-2026-54673

Name of the Vulnerable Software and Affected Versions electron-updater versions prior to 9.7.0

Description The HTTP redirect handler HttpExecutor.prepareRedirectUrlOptions() only removes credential headers that exactly match the lowercase string "authorization". Consequently, other credential-bearing headers, such as PRIVATE-TOKEN or mixed-case Authorization headers, are not stripped and may be forwarded to an attacker-controlled cross-origin redirect destination, leading to credential exposure.

Recommendations Update to version 9.7.0.