The @angular/service-worker package in Angular improperly preserves sensitive request headers (e.g., Authorization, Proxy-Authorization, cookies) when handling cross-origin redirects during asset fetching. This behavior violates the Fetch redirect algorithm, which requires stripping such headers on cross-origin redirects. As a result, an attacker controlling the redirect destination can obtain sensitive credentials. Exploitation requires the application to use the vulnerable service worker version, send credentialed requests, and have those requests redirected cross-origin to an attacker-controlled domain. Patched versions include 20.3.25, 21.2.17, and 22.0.1.

Sensitive credentials such as Authorization tokens, Proxy-Authorization headers, or session cookies can be exposed to unauthorized third-party servers if a cross-origin redirect occurs during asset fetching by the Angular Service Worker. This can lead to information disclosure and potential unauthorized access to user accounts or services relying on those credentials.

Upgrade the @angular/service-worker package to one of the patched versions: 20.3.25, 21.2.17, or 22.0.1. These versions contain fixes that prevent sensitive headers from being forwarded on cross-origin redirects. Until upgrading, avoid configurations that send credentialed requests which may be redirected cross-origin.