CVE-2026-54673 is a cross-origin redirect leak vulnerability affecting builder-util-runtime versions < 9.7.0 in electron-updater that discloses GitLab personal access tokens and Bearer/OAuth tokens. The issue arises from the HTTP redirect handler, HttpExecutor.prepareRedirectUrlOptions, which only strips a credential header whose key string matches exactly lowercase "authorization". Other credential-bearing headers, including PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization (used by GitLab's Bearer/OAuth flow), are not stripped and can be forwarded to an attacker-controlled cross-origin redirect destination. This vulnerability affects versions prior to v26.15.0 of electron-builder, specifically the builder-util-runtime package, which contains the vulnerable code introduced via PR #9211 and first released in v26.0.20. The affected component is the HTTP redirect handler, which bypasses the guard for non-lowercase "authorization" headers, allowing an attacker to obtain sensitive credentials. This vulnerability can be exploited by an automatic update check that leaks GitLab personal access tokens or Bearer/OAuth tokens sent under a mixed-case Authorization key. An attacker who controls or can observe the redirect destination receives the token, granting them unauthorized access to private source code, packages, or release artifacts.
We recommend you to update builder-util-runtime to version 9.7.0.[/subscribe_to_unlock_form]
CVE-2026-54673 is a cross-origin redirect leak vulnerability affecting builder-util-runtime versions < 9.7.0 in electron-updater that discloses GitLab personal access tokens and Bearer/OAuth tokens. The issue arises from the HTTP redirect handler, HttpExecutor.prepareRedirectUrlOptions, which only strips a credential header whose key string matches exactly lowercase "authorization". Other credential-bearing headers, including PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization (used by GitLab's Bearer/OAuth flow), are not stripped and can be forwarded to an attacker-controlled cross-origin redirect destination. This vulnerability affects versions prior to v26.15.0 of electron-builder, specifically the builder-util-runtime package, which contains the vulnerable code introduced via PR #9211 and first released in v26.0.20. The affected component is the HTTP redirect handler, which bypasses the guard for non-lowercase "authorization" headers, allowing an attacker to obtain sensitive credentials. This vulnerability can be exploited by an automatic update check that leaks GitLab personal access tokens or Bearer/OAuth tokens sent under a mixed-case Authorization key. An attacker who controls or can observe the redirect destination receives the token, granting them unauthorized access to private source code, packages, or release artifacts.
We recommend you to update builder-util-runtime to version 9.7.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]