CVE-2026-54673

electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase "authorization", exposing credentials. Other credential-bearing headers — most notably PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization (used by GitLab's Bearer/OAuth flow) — were not stripped and could be forwarded to an attacker-controlled cross-origin redirect destination. This issue has been fixed in version 9.7.0.

• CWE-200

• https://github.com/electron-userland/electron-builder/commit/22a7532bd01b9fb42cff7c58d599c7ad683569fePatch
• https://github.com/electron-userland/electron-builder/security/advisories/GHSA-p2f4-r6v6-j797Vendor Advisory, Exploit, Mitigation, Patch
• https://github.com/electron-userland/electron-builder/security/advisories/GHSA-p2f4-r6v6-j797Vendor Advisory, Exploit, Mitigation, Patch

Published

Jun 30, 2026

Last Modified

Aug 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54665Apache NiFi 0.0.1 through 2.9.0 support building qualified U…5.3
• CVE-2026-54666swagger-typescript-api generates API clients for Fetch or Ax…8.3
• CVE-2026-5467A vulnerability was identified in Casdoor 2.356.0. Affected …6.1
• CVE-2026-54670WeGIA is a web manager for charitable institutions. Prior to…9.1
• CVE-2026-54671WeGIA is a web manager for charitable institutions. Prior to…8.8
• CVE-2026-54672electron-updater allows for automatic updates for Electron a…7.8
• CVE-2026-54676Scoold is a Q&A and a knowledge sharing platform for teams. …6.5
• CVE-2026-54677Scoold is a Q&A and a knowledge sharing platform for teams. …6.5
• CVE-2026-54679jq is a command-line JSON processor. Prior to 1.8.2, on 32bi…5.5
• CVE-2026-5468A security flaw has been discovered in Casdoor 2.356.0. This…5.4
• CVE-2026-54680Logging operator automates the deployment and configuration …9.9
• CVE-2026-54681DiscordChatExporter saves Discord chat logs to a file. Prior…4.1