The electron-updater component manages automatic updates for Electron applications. In versions before 9.7.0 the HTTP redirect handler only removed headers whose key was exactly "authorization" in lowercase, leaving headers such as PRIVATE-TOKEN and mixed‑case Authorization intact when a redirect was followed. An attacker who can supply or convince the application to follow a redirect to a malicious domain could therefore have these credential headers forwarded, exposing sensitive authentication data. This behaviour corresponds to CWE-200 and CWE-201.

The flaw exists in the builder-util-runtime library that is used by electron-builder, affecting all releases of that library and the electron-builder package up to, but not including, version 9.7.0. Applications that rely on electron-updater for automatic updates and that include private tokens or other credential headers in the update request are potentially impacted.

The CVSS score of 8.2 indicates high severity. The EPSS score of < 1% suggests a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to control or influence the update process so that the client follows a redirect to a malicious domain. Once the redirect occurs, the preserved PRIVATE‑TOKEN or Authorization headers are forwarded to that domain, resulting in credential compromise. No elevated privileges or special user interaction beyond normal update usage are required.