Threat Advisory

Electron-Updater Flaw Leaks Credentials and Private Tokens

Threat: Vulnerability
Targeted Region: Global
Targeted Sector: Technology & IT
Criticality: High
[subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

CVE-2026-54673 is a cross-origin redirect leak vulnerability affecting builder-util-runtime versions < 9.7.0 in electron-updater that discloses GitLab personal access tokens and Bearer/OAuth tokens. The issue arises from the HTTP redirect handler, HttpExecutor.prepareRedirectUrlOptions, which only strips a credential header whose key string matches exactly lowercase "authorization". Other credential-bearing headers, including PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization (used by GitLab's Bearer/OAuth flow), are not stripped and can be forwarded to an attacker-controlled cross-origin redirect destination. This vulnerability affects versions prior to v26.15.0 of electron-builder, specifically the builder-util-runtime package, which contains the vulnerable code introduced via PR #9211 and first released in v26.0.20. The affected component is the HTTP redirect handler, which bypasses the guard for non-lowercase "authorization" headers, allowing an attacker to obtain sensitive credentials. This vulnerability can be exploited by an automatic update check that leaks GitLab personal access tokens or Bearer/OAuth tokens sent under a mixed-case Authorization key. An attacker who controls or can observe the redirect destination receives the token, granting them unauthorized access to private source code, packages, or release artifacts.

RECOMMENDATION:

We recommend you to update builder-util-runtime to version 9.7.0.[/subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

CVE-2026-54673 is a cross-origin redirect leak vulnerability affecting builder-util-runtime versions < 9.7.0 in electron-updater that discloses GitLab personal access tokens and Bearer/OAuth tokens. The issue arises from the HTTP redirect handler, HttpExecutor.prepareRedirectUrlOptions, which only strips a credential header whose key string matches exactly lowercase "authorization". Other credential-bearing headers, including PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization (used by GitLab's Bearer/OAuth flow), are not stripped and can be forwarded to an attacker-controlled cross-origin redirect destination. This vulnerability affects versions prior to v26.15.0 of electron-builder, specifically the builder-util-runtime package, which contains the vulnerable code introduced via PR #9211 and first released in v26.0.20. The affected component is the HTTP redirect handler, which bypasses the guard for non-lowercase "authorization" headers, allowing an attacker to obtain sensitive credentials. This vulnerability can be exploited by an automatic update check that leaks GitLab personal access tokens or Bearer/OAuth tokens sent under a mixed-case Authorization key. An attacker who controls or can observe the redirect destination receives the token, granting them unauthorized access to private source code, packages, or release artifacts.

RECOMMENDATION:

We recommend you to update builder-util-runtime to version 9.7.0.[emaillocker id="1283"]

REFERENCES:

The following reports contain further technical details:

[/emaillocker]
crossmenu