electron-updater CVE-2026-54673

Exploitation requires that the target application uses electron-updater (< 9.7.0) with a credentialed update feed that sends a header other than exactly-lowercase "authorization" - concretely GitLab's PRIVATE-TOKEN personal-access-token header or a mixed-case Authorization Bearer/OAuth header - and that the update request encounters an HTTP redirect to a host the attacker controls or can inject. Limiting factors: the app must actually attach credentials to update requests (public/unauthenticated feeds leak nothing), an update check must occur (UI:P passive interaction), and the attacker must control the redirect destination or the upstream feed/redirect path (PR:L); apps that already use a lowercase "authorization" header or pin redirects to a trusted origin are not exposed.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, base 8.2) reflects a network-reachable, low-complexity issue with high confidentiality impact on both the vulnerable and a subsequent system (SC:H captures the credential crossing into the attacker's origin), no integrity/availability impact, and passive user interaction - the update check itself. PR:L and UI:P are the key limiters: exploitation only matters for apps that ship credentialed update feeds (notably GitLab PAT/OAuth) and that follow a redirect to a host the attacker influences. No EPSS score, KEV listing, or POC was provided, and the issue is information disclosure rather than code execution, so this is a real-but-conditional priority - high for teams shipping Electron apps with GitLab-authenticated private update channels, lower for apps using public/GitHub feeds without sensitive tokens. No EPSS data is available to gauge exploitation probability in the wild.

An Electron app configured to pull updates from a private GitLab feed sends its PRIVATE-TOKEN or Authorization header to the update server; an attacker who can influence or compromise that server (or a host in the redirect path) returns a 3xx redirect to an attacker-controlled origin. Because electron-updater fails to strip the non-lowercase-"authorization" credential header on redirect, the user's GitLab token is replayed to the attacker, who then uses it to access the victim's GitLab resources. No public exploit was identified at time of analysis, but the fix commit publicly reveals the vulnerable matching logic.