Vulnerability-Lookup

CVE-2026-45793 (GCVE-0-2026-45793)

Vulnerability from cvelistv5 – Published: 2026-07-15 16:22 – Updated: 2026-07-15 18:11

Title

Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs

Summary

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M

References

9 references

URL	Tags
https://github.com/composer/composer/security/adv…	x_refsource_CONFIRM
https://github.com/composer/composer/pull/12853	x_refsource_MISC
https://github.com/composer/composer/pull/12855	x_refsource_MISC
https://github.com/composer/composer/commit/3f5e7…	x_refsource_MISC
https://github.com/composer/composer/commit/65e63…	x_refsource_MISC
https://github.com/composer/composer/commit/e66c8…	x_refsource_MISC
https://github.com/composer/composer/releases/tag…	x_refsource_MISC
https://github.com/composer/composer/releases/tag…	x_refsource_MISC
https://github.com/composer/composer/releases/tag/2.9.8	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
composer	composer	Affected: >= 1.0, < 1.10.28 Affected: >= 2.0.0, < 2.2.28 Affected: >= 2.3.0, < 2.9.8

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45793",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T18:11:02.102503Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T18:11:10.355Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "composer",
          "vendor": "composer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0, \u003c 1.10.28"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.2.28"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.3.0, \u003c 2.9.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\\IO\\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_\u003cid\u003e_\u003cbase64url-JWT\u003e format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-15T16:22:19.418Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2"
        },
        {
          "name": "https://github.com/composer/composer/pull/12853",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/composer/composer/pull/12853"
        },
        {
          "name": "https://github.com/composer/composer/pull/12855",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/composer/composer/pull/12855"
        },
        {
          "name": "https://github.com/composer/composer/commit/3f5e7f9fbfa541137d6d1d5643ec3b718e9d5039",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/composer/composer/commit/3f5e7f9fbfa541137d6d1d5643ec3b718e9d5039"
        },
        {
          "name": "https://github.com/composer/composer/commit/65e6390c49f1a11cd8b660d81822086db51fe2d1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/composer/composer/commit/65e6390c49f1a11cd8b660d81822086db51fe2d1"
        },
        {
          "name": "https://github.com/composer/composer/commit/e66c8fdb7ff5409bd2f358c5f194038e49e93714",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/composer/composer/commit/e66c8fdb7ff5409bd2f358c5f194038e49e93714"
        },
        {
          "name": "https://github.com/composer/composer/releases/tag/1.10.28",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/composer/composer/releases/tag/1.10.28"
        },
        {
          "name": "https://github.com/composer/composer/releases/tag/2.2.28",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/composer/composer/releases/tag/2.2.28"
        },
        {
          "name": "https://github.com/composer/composer/releases/tag/2.9.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/composer/composer/releases/tag/2.9.8"
        }
      ],
      "source": {
        "advisory": "GHSA-f9f8-rm49-7jv2",
        "discovery": "UNKNOWN"
      },
      "title": "Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45793",
    "datePublished": "2026-07-15T16:22:19.418Z",
    "dateReserved": "2026-05-13T08:19:32.603Z",
    "dateUpdated": "2026-07-15T18:11:10.355Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45793",
      "date": "2026-07-16",
      "epss": "0.00519",
      "percentile": "0.40652"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-45793\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-15T17:16:48.173\",\"lastModified\":\"2026-07-15T20:54:43.733\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\\\\IO\\\\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_\u003cid\u003e_\u003cbase64url-JWT\u003e format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"composer\",\"product\":\"composer\",\"versions\":[{\"version\":\"\u003e= 1.0, \u003c 1.10.28\",\"status\":\"affected\"},{\"version\":\"\u003e= 2.0.0, \u003c 2.2.28\",\"status\":\"affected\"},{\"version\":\"\u003e= 2.3.0, \u003c 2.9.8\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-15T18:11:02.102503Z\",\"id\":\"CVE-2026-45793\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"references\":[{\"url\":\"https://github.com/composer/composer/commit/3f5e7f9fbfa541137d6d1d5643ec3b718e9d5039\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/composer/composer/commit/65e6390c49f1a11cd8b660d81822086db51fe2d1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/composer/composer/commit/e66c8fdb7ff5409bd2f358c5f194038e49e93714\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/composer/composer/pull/12853\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/composer/composer/pull/12855\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/composer/composer/releases/tag/1.10.28\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/composer/composer/releases/tag/2.2.28\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/composer/composer/releases/tag/2.9.8\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-45793\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-15T18:11:02.102503Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-15T18:11:07.531Z\"}}], \"cna\": {\"title\": \"Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs\", \"source\": {\"advisory\": \"GHSA-f9f8-rm49-7jv2\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"composer\", \"product\": \"composer\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 1.0, \u003c 1.10.28\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.0.0, \u003c 2.2.28\"}, {\"status\": \"affected\", \"version\": \"\u003e= 2.3.0, \u003c 2.9.8\"}]}], \"references\": [{\"url\": \"https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2\", \"name\": \"https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/composer/composer/pull/12853\", \"name\": \"https://github.com/composer/composer/pull/12853\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/composer/composer/pull/12855\", \"name\": \"https://github.com/composer/composer/pull/12855\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/composer/composer/commit/3f5e7f9fbfa541137d6d1d5643ec3b718e9d5039\", \"name\": \"https://github.com/composer/composer/commit/3f5e7f9fbfa541137d6d1d5643ec3b718e9d5039\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/composer/composer/commit/65e6390c49f1a11cd8b660d81822086db51fe2d1\", \"name\": \"https://github.com/composer/composer/commit/65e6390c49f1a11cd8b660d81822086db51fe2d1\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/composer/composer/commit/e66c8fdb7ff5409bd2f358c5f194038e49e93714\", \"name\": \"https://github.com/composer/composer/commit/e66c8fdb7ff5409bd2f358c5f194038e49e93714\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/composer/composer/releases/tag/1.10.28\", \"name\": \"https://github.com/composer/composer/releases/tag/1.10.28\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/composer/composer/releases/tag/2.2.28\", \"name\": \"https://github.com/composer/composer/releases/tag/2.2.28\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/composer/composer/releases/tag/2.9.8\", \"name\": \"https://github.com/composer/composer/releases/tag/2.9.8\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\\\\IO\\\\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_\u003cid\u003e_\u003cbase64url-JWT\u003e format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-15T16:22:19.418Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-45793\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-15T18:11:10.355Z\", \"dateReserved\": \"2026-05-13T08:19:32.603Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-07-15T16:22:19.418Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-45793

Vulnerability from fkie_nvd - Published: 2026-07-15 17:16 - Updated: 2026-07-15 20:54

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/composer/composer/commit/3f5e7f9fbfa541137d6d1d5643ec3b718e9d5039
	security-advisories@github.com	https://github.com/composer/composer/commit/65e6390c49f1a11cd8b660d81822086db51fe2d1
	security-advisories@github.com	https://github.com/composer/composer/commit/e66c8fdb7ff5409bd2f358c5f194038e49e93714
	security-advisories@github.com	https://github.com/composer/composer/pull/12853
	security-advisories@github.com	https://github.com/composer/composer/pull/12855
	security-advisories@github.com	https://github.com/composer/composer/releases/tag/1.10.28
	security-advisories@github.com	https://github.com/composer/composer/releases/tag/2.2.28
	security-advisories@github.com	https://github.com/composer/composer/releases/tag/2.9.8
	security-advisories@github.com	https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "composer",
          "vendor": "composer",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0, \u003c 1.10.28"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.2.28"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.3.0, \u003c 2.9.8"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\\IO\\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_\u003cid\u003e_\u003cbase64url-JWT\u003e format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8."
    }
  ],
  "id": "CVE-2026-45793",
  "lastModified": "2026-07-15T20:54:43.733",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45793",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-15T18:11:02.102503Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-15T17:16:48.173",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/commit/3f5e7f9fbfa541137d6d1d5643ec3b718e9d5039"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/commit/65e6390c49f1a11cd8b660d81822086db51fe2d1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/commit/e66c8fdb7ff5409bd2f358c5f194038e49e93714"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/pull/12853"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/pull/12855"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/releases/tag/1.10.28"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/releases/tag/2.2.28"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/releases/tag/2.9.8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-F9F8-RM49-7JV2

Vulnerability from github – Published: 2026-05-19 16:17 – Updated: 2026-05-19 16:17

Summary

Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs

Details

Summary

Composer leaks the full contents of tokens configured as GitHub OAuth tokens if they do not match Composer's expected format for such tokens to stderr. GitHub has introduced a new format for GitHub Actions GITHUB_TOKEN values. These tokens are validated in the same way by Composer on GitHub Actions. The new format including a - (hyphen) fails Composer's validation and leads to disclosure of the GITHUB_TOKEN in logs.

Many widely-used Actions (e.g. shivammathur/setup-php) auto-register GITHUB_TOKEN into composer's global auth.json, so the leak triggers without any unusual user configuration.

GitHub Actions tokens expire when the associated job finishes, and they are scoped to the respective repository only. So in most regular cases the Composer validation, which errors while leaking the token, also immediately ends the job, expiring the token immediately. Tokens expire at the very latest after 6 hours on GitHub-hosted runners. If you use self-hosted runner, expiration is at most 24 hours after creation. The new token format is being rolled out gradually, so not all repositories are affected yet, but will be soon.

Classic ghp_ PATs are not affected by the regex bug per se, but the same leak primitive applies to any future credential that fails validation for any reason.

Details

When a GitHub token fails regular expression validation of the character set, the rejected token is interpolated verbatim into the UnexpectedValueException message thrown by Composer\IO\BaseIO::loadConfiguration(), which Symfony Console then prints. Validation reliably fails for any token containing a - (hyphen), which includes the modern ghs_<id>_<base64url-JWT> GitHub App installation token format, the same format used by GitHub Actions' built-in GITHUB_TOKEN and by actions/create-github-app-token.

Severity: medium. Pre-conditions are common in real-world CI. Practical blast radius is bounded by the leaked credential's scope and TTL (short for a workflow GITHUB_TOKEN, longer for App-minted tokens or user-issued credentials that happen to contain -).

Vulnerable code, src/Composer/IO/BaseIO.php (line 139 on main, line 143 on 2.8.x), inside loadConfiguration():

// allowed chars for GH tokens are from https://github.blog/changelog/2021-03-04-authentication-token-format-updates/
// plus dots which were at some point used for GH app integration tokens
if (!Preg::isMatch('{^[.A-Za-z0-9_]+$}', $token)) {
    throw new \UnexpectedValueException(
        'Your github oauth token for '.$domain.' contains invalid characters: "'.$token.'"'
    );
}

Three issues combine to produce the leak:

The rejected token is interpolated into the exception message. The exception bubbles up to Symfony Console's default error renderer, which writes it to stderr. Any environment that captures stderr (CI logs, log shippers, monitoring, support transcripts) now has the raw token.
The validation regex ^[.A-Za-z0-9_]+$ does not permit -. GitHub's current ghs_<numeric-id>_<base64url-JWT> structured installation tokens routinely contain -, because base64url (RFC 4648 §5) uses - and _ as URL-safe replacements for + and /. The regex was chosen in 2021 on the understanding that GitHub tokens use only [A-Za-z0-9_] plus ..
Detection / mitigation in upstream platforms is unreliable. GitHub Actions' built-in secret masker matches registered values as exact substrings. When the exception message is rendered by Symfony Console it may wrap, embed in In BaseIO.php line N: framing, or interleave with ANSI control sequences. So the masker does not redact, and the plaintext token reaches the log.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "composer/composer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.3.0"
            },
            {
              "fixed": "2.9.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "composer/composer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.2.28"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "composer/composer"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0"
            },
            {
              "fixed": "1.10.28"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45793"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-19T16:17:58Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nComposer leaks the full contents of tokens configured as GitHub OAuth tokens if they do not match Composer\u0027s expected format for such tokens to stderr. GitHub has introduced a new format for GitHub Actions GITHUB_TOKEN values. These tokens are validated in the same way by Composer on GitHub Actions. The new format including a `-` (hyphen) fails Composer\u0027s validation and leads to disclosure of the GITHUB_TOKEN in logs.\n\nMany widely-used Actions (e.g. `shivammathur/setup-php`) auto-register `GITHUB_TOKEN` into composer\u0027s global `auth.json`, so the leak triggers without any unusual user configuration.\n\nGitHub Actions tokens expire when the associated job finishes, and they are scoped to the respective repository only. So in most regular cases the Composer validation, which errors while leaking the token, also immediately ends the job, expiring the token immediately. Tokens expire at the very latest after 6 hours on GitHub-hosted runners. If you use self-hosted runner, expiration is at most 24 hours after creation. The new token format is being rolled out gradually, so not all repositories are affected yet, but will be soon.\n\nClassic `ghp_` PATs are not affected by the regex bug per se, but the same leak primitive applies to any future credential that fails validation for any reason.\n\n### Details\n\nWhen a GitHub token fails regular expression validation of the character set, the rejected token is interpolated verbatim into the `UnexpectedValueException` message thrown by `Composer\\IO\\BaseIO::loadConfiguration()`, which Symfony Console then prints. Validation reliably fails for any token containing a `-` (hyphen), which includes the modern `ghs_\u003cid\u003e_\u003cbase64url-JWT\u003e` GitHub App installation token format, the same format used by GitHub Actions\u0027 built-in `GITHUB_TOKEN` and by `actions/create-github-app-token`. \n\nSeverity: medium. Pre-conditions are common in real-world CI. Practical blast radius is bounded by the leaked credential\u0027s scope and TTL (short for a workflow `GITHUB_TOKEN`, longer for App-minted tokens or user-issued credentials that happen to contain `-`).\n\nVulnerable code, `src/Composer/IO/BaseIO.php` (line 139 on `main`, line 143 on 2.8.x), inside `loadConfiguration()`:\n\n```php\n// allowed chars for GH tokens are from https://github.blog/changelog/2021-03-04-authentication-token-format-updates/\n// plus dots which were at some point used for GH app integration tokens\nif (!Preg::isMatch(\u0027{^[.A-Za-z0-9_]+$}\u0027, $token)) {\n    throw new \\UnexpectedValueException(\n        \u0027Your github oauth token for \u0027.$domain.\u0027 contains invalid characters: \"\u0027.$token.\u0027\"\u0027\n    );\n}\n```\n\nThree issues combine to produce the leak:\n\n1. **The rejected token is interpolated into the exception message.** The exception bubbles up to Symfony Console\u0027s default error renderer, which writes it to stderr. Any environment that captures stderr (CI logs, log shippers, monitoring, support transcripts) now has the raw token.\n\n2. **The validation regex `^[.A-Za-z0-9_]+$` does not permit `-`.** GitHub\u0027s current `ghs_\u003cnumeric-id\u003e_\u003cbase64url-JWT\u003e` structured installation tokens routinely contain `-`, because base64url (RFC 4648 \u00a75) uses `-` and `_` as URL-safe replacements for `+` and `/`. The regex was chosen in 2021 on the understanding that GitHub tokens use only `[A-Za-z0-9_]` plus `.`.\n\n3. **Detection / mitigation in upstream platforms is unreliable.** GitHub Actions\u0027 built-in secret masker matches registered values as exact substrings. When the exception message is rendered by Symfony Console it may wrap, embed in `In BaseIO.php line N:` framing, or interleave with ANSI control sequences. So the masker does not redact, and the plaintext token reaches the log.",
  "id": "GHSA-f9f8-rm49-7jv2",
  "modified": "2026-05-19T16:17:58Z",
  "published": "2026-05-19T16:17:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2026-45793.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/composer/composer"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs"
}

ubuntu-cve-2026-45793

Vulnerability from osv_ubuntu

Published

2026-05-20 00:00

Modified

2026-05-20 00:00

Summary

Details

[Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs]

Severity

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-45793	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-45793	REPORT
	https://github.com/composer/composer/security/adv…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "1.0.0~beta2-1ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@1.0.0~beta2-1ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.0~alpha10+20150602-1",
        "1.0.0~alpha10+20150602-2",
        "1.0.0~alpha11-1",
        "1.0.0~alpha11-1ubuntu1",
        "1.0.0~alpha11-2",
        "1.0.0~alpha11-3",
        "1.0.0~beta1-1ubuntu1",
        "1.0.0~beta2-1",
        "1.0.0~beta2-1ubuntu0.1~esm1",
        "1.0.0~beta2-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "1.6.3-1ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@1.6.3-1ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.1-1",
        "1.5.2-1",
        "1.6.2-1",
        "1.6.3-1",
        "1.6.3-1ubuntu0.1~esm1",
        "1.6.3-1ubuntu0.1~esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "composer",
            "binary_version": "1.10.1-1ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "composer",
        "purl": "pkg:deb/ubuntu/composer@1.10.1-1ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.9.0-2",
        "1.9.1-1",
        "1.9.2-1",
        "1.9.3-1",
        "1.10.0-1",
        "1.10.1-1",
        "1.10.1-1ubuntu0.1~esm1",
        "1.10.1-1ubuntu0.1~esm2"
      ]
    }
  ],
  "aliases": [],
  "details": "[Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs]",
  "id": "UBUNTU-CVE-2026-45793",
  "modified": "2026-05-20T00:00:00Z",
  "published": "2026-05-20T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-45793"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45793"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-45793"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-45793 (GCVE-0-2026-45793)

FKIE_CVE-2026-45793

GHSA-F9F8-RM49-7JV2

Summary

Details

ubuntu-cve-2026-45793

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature