{"id":"CVE-2026-45793","aliases":["ALPINE-CVE-2026-45793","BIT-composer-2026-45793","DEBIAN-CVE-2026-45793","EUVD-2026-44723","GHSA-f9f8-rm49-7jv2","SUSE-SU-2026:23116-1","SUSE-SU-2026:23138-1","SUSE-SU-2026:23943-1","SUSE-SU-2026:3105-1","SUSE-SU-2026:4283-1","SUSE-SU-2026:4288-1","UBUNTU-CVE-2026-45793","openSUSE-SU-2026:11300-1","openSUSE-SU-2026:21520-1","openSUSE-SU-2026:21970-1"],"status":"published","title":"Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs","description":"Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\\IO\\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_\u003cid\u003e_\u003cbase64url-JWT\u003e format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01021,"percentile":0.63844,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2026-05-19T16:17:58Z","modified":"2026-11-03T06:32:55Z","fixes":[{"ecosystem":"Packagist","package":"composer/composer","fixed_in":["2.9.8","2.2.28","1.10.28"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.24","package":"composer","fixed_in":["2.9.8-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"composer","fixed_in":["1.10.28","2.2.28","2.9.8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"composer","fixed_in":["2.5.5-1+deb12u5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"composer","fixed_in":["2.8.8-1+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"composer","fixed_in":["2.10.0-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"php-composer2","fixed_in":["2.10.2-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"composer/composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.9.8"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"composer/composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.2.28"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"composer/composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"1.10.28"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.8-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"composer","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"1.10.28"},{"introduced":"2.0.0"},{"fixed":"2.2.28"},{"introduced":"2.3.0"},{"fixed":"2.9.8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.5-1+deb12u5"}]}],"versions":["2.5.5-1","2.5.5-1+deb12u1","2.5.5-1+deb12u2","2.5.5-1+deb12u3","2.5.5-1+deb12u4"]},{"source":"osv","ecosystem":"Debian:13","package":"composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.8-1+deb13u3"}]}],"versions":["2.8.8-1","2.8.8-1+deb13u1","2.8.8-1+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-1"}]}],"versions":["2.10.0~rc1-1","2.10.0~rc1-2","2.10.0~rc1-3","2.10.0~rc2-1","2.8.10-1","2.8.11-1","2.8.11-2","2.8.12-1","2.8.8-1","2.8.9-1","2.9.0~rc1-1","2.9.1-1","2.9.2-1","2.9.3-1","2.9.4-1","2.9.5-1","2.9.7-1","2.9.8-1"]},{"source":"osv","ecosystem":"Packagist","package":"composer/composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.9.8"}]}],"versions":["2.3.0","2.3.1","2.3.10","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9","2.4.0","2.4.0-RC1","2.4.1","2.4.2","2.4.3","2.4.4","2.5.0","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.5.6","2.5.7","2.5.8","2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.7.0","2.7.1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","2.8.0","2.8.1","2.8.10","2.8.11","2.8.12","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0","2.9.0-RC1","2.9.1","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7"]},{"source":"osv","ecosystem":"Packagist","package":"composer/composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.2.28"}]}],"versions":["2.0.0","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.1.0-RC1","2.1.1","2.1.10","2.1.11","2.1.12","2.1.14","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.0-RC1","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.16","2.2.17","2.2.18","2.2.19","2.2.2","2.2.20","2.2.21","2.2.22","2.2.23","2.2.24","2.2.25","2.2.26","2.2.27","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9"]},{"source":"osv","ecosystem":"Packagist","package":"composer/composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"1.10.28"}]}],"versions":["1.0.0","1.0.0-alpha1","1.0.0-alpha10","1.0.0-alpha11","1.0.0-alpha2","1.0.0-alpha3","1.0.0-alpha4","1.0.0-alpha5","1.0.0-alpha6","1.0.0-alpha7","1.0.0-alpha8","1.0.0-alpha9","1.0.0-beta1","1.0.0-beta2","1.0.1","1.0.2","1.0.3","1.1.0","1.1.0-RC","1.1.1","1.1.2","1.1.3","1.10.0","1.10.0-RC","1.10.1","1.10.10","1.10.11","1.10.12","1.10.13","1.10.14","1.10.15","1.10.16","1.10.17","1.10.18","1.10.19","1.10.2","1.10.20","1.10.21","1.10.22","1.10.23","1.10.24","1.10.25","1.10.26","1.10.27","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7","1.10.8","1.10.9","1.2.0","1.2.0-RC","1.2.1","1.2.2","1.2.3","1.2.4","1.3.0","1.3.0-RC","1.3.1","1.3.2","1.3.3","1.4.0","1.4.1","1.4.2","1.4.3","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.6.0","1.6.0-RC","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.7.0","1.7.0-RC","1.7.1","1.7.2","1.7.3","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.9.0","1.9.1","1.9.2","1.9.3"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9-160000.4.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9-160000.4.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9-160000.4.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9-160000.4.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9-160000.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9-160000.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-150600.3.12.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-150600.3.12.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-150600.3.12.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.30-150400.3.21.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.30-150400.3.21.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.30-150400.3.21.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.30-150400.3.21.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.30-150400.3.21.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.30-150400.3.21.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.30-150400.3.21.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.30-150400.3.21.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.4-150600.3.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0~alpha10+20150602-1","1.0.0~alpha10+20150602-2","1.0.0~alpha11-1","1.0.0~alpha11-1ubuntu1","1.0.0~alpha11-2","1.0.0~alpha11-3","1.0.0~beta1-1ubuntu1","1.0.0~beta2-1","1.0.0~beta2-1ubuntu0.1~esm1","1.0.0~beta2-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.1-1","1.5.2-1","1.6.2-1","1.6.3-1","1.6.3-1ubuntu0.1~esm1","1.6.3-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"composer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.0-2","1.9.1-1","1.9.2-1","1.9.3-1","1.10.0-1","1.10.1-1","1.10.1-1ubuntu0.1~esm1","1.10.1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.2-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9-160000.4.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"php-composer2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.9-160000.6.1"}]}],"bundled":3}],"products":[{"vendor":"composer","product":"composer"}],"references":[{"url":"https://github.com/composer/composer/security/advisories/GHSA-f9f8-rm49-7jv2","tags":["x_refsource_CONFIRM","web","advisory","report"]},{"url":"https://github.com/composer/composer/pull/12853","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/composer/composer/pull/12855","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/composer/composer/commit/3f5e7f9fbfa541137d6d1d5643ec3b718e9d5039","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/composer/composer/commit/65e6390c49f1a11cd8b660d81822086db51fe2d1","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/composer/composer/commit/e66c8fdb7ff5409bd2f358c5f194038e49e93714","tags":["x_refsource_MISC","web","fix"]},{"url":"https://github.com/composer/composer/releases/tag/1.10.28","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/composer/composer/releases/tag/2.2.28","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/composer/composer/releases/tag/2.9.8","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/composer/composer/CVE-2026-45793.yaml","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45793","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-f9f8-rm49-7jv2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-45793","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45793.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-45793","tags":["advisory"]},{"url":"https://github.com/composer/composer","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623116-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271122","tags":["report"]},{"url":"https://bugzilla.suse.com/1271129","tags":["report"]},{"url":"https://bugzilla.suse.com/1271151","tags":["report"]},{"url":"https://bugzilla.suse.com/1271504","tags":["report"]},{"url":"https://bugzilla.suse.com/1271729","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40261","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59948","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623138-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623943-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1279898","tags":["report"]},{"url":"https://bugzilla.suse.com/1280019","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59944","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263105-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35242","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264283-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271123","tags":["report"]},{"url":"https://bugzilla.suse.com/1271130","tags":["report"]},{"url":"https://bugzilla.suse.com/1271152","tags":["report"]},{"url":"https://bugzilla.suse.com/1278257","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84361","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264288-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-45793","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45793","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-45793","title":"Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs","description":"Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\\IO\\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_\u003cid\u003e_\u003cbase64url-JWT\u003e format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.","status":"published","published":"2026-07-15T16:22:19.418Z","modified":"2026-07-15T18:11:10.355Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T13:46:43.922571Z"}],"euvd":[{"id":"EUVD-2026-44723","description":"Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\\IO\\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_\u003cid\u003e_\u003cbase64url-JWT\u003e format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.","status":"published","published":"2026-07-15T16:22:19Z","modified":"2026-07-15T18:11:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:19:52.35951Z"}],"ghsa":[{"id":"GHSA-f9f8-rm49-7jv2","title":"Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs","description":"### Summary\n\nComposer leaks the full contents of tokens configured as GitHub OAuth tokens if they do not match Composer's expected format for such tokens to stderr. GitHub has introduced a new format for GitHub Actions GITHUB_TOKEN values. These tokens are validated in the same way by Composer on GitHub Actions. The new format including a `-` (hyphen) fails Composer's validation and leads to disclosure of the GITHUB_TOKEN in logs.\n\nMany widely-used Actions (e.g. `shivammathur/setup-php`) auto-register `GITHUB_TOKEN` into composer's global `auth.json`, so the leak triggers without any unusual user configuration.\n\nGitHub Actions tokens expire when the associated job finishes, and they are scoped to the respective repository only. So in most regular cases the Composer validation, which errors while leaking the token, also immediately ends the job, expiring the token immediately. Tokens expire at the very latest after 6 hours on GitHub-hosted runners. If you use self-hosted runner, expiration is at most 24 hours after creation. The new token format is being rolled out gradually, so not all repositories are affected yet, but will be soon.\n\nClassic `ghp_` PATs are not affected by the regex bug per se, but the same leak primitive applies to any future credential that fails validation for any reason.\n\n### Details\n\nWhen a GitHub token fails regular expression validation of the character set, the rejected token is interpolated verbatim into the `UnexpectedValueException` message thrown by `Composer\\IO\\BaseIO::loadConfiguration()`, which Symfony Console then prints. Validation reliably fails for any token containing a `-` (hyphen), which includes the modern `ghs_\u003cid\u003e_\u003cbase64url-JWT\u003e` GitHub App installation token format, the same format used by GitHub Actions' built-in `GITHUB_TOKEN` and by `actions/create-github-app-token`. \n\nSeverity: medium. Pre-conditions are common in real-world CI. Practical blast radius is bounded by the leaked credential's scope and TTL (short for a workflow `GITHUB_TOKEN`, longer for App-minted tokens or user-issued credentials that happen to contain `-`).\n\nVulnerable code, `src/Composer/IO/BaseIO.php` (line 139 on `main`, line 143 on 2.8.x), inside `loadConfiguration()`:\n\n```php\n// allowed chars for GH tokens are from https://github.blog/changelog/2021-03-04-authentication-token-format-updates/\n// plus dots which were at some point used for GH app integration tokens\nif (!Preg::isMatch('{^[.A-Za-z0-9_]+$}', $token)) {\n    throw new \\UnexpectedValueException(\n        'Your github oauth token for '.$domain.' contains invalid characters: \"'.$token.'\"'\n    );\n}\n```\n\nThree issues combine to produce the leak:\n\n1. **The rejected token is interpolated into the exception message.** The exception bubbles up to Symfony Console's default error renderer, which writes it to stderr. Any environment that captures stderr (CI logs, log shippers, monitoring, support transcripts) now has the raw token.\n\n2. **The validation regex `^[.A-Za-z0-9_]+$` does not permit `-`.** GitHub's current `ghs_\u003cnumeric-id\u003e_\u003cbase64url-JWT\u003e` structured installation tokens routinely contain `-`, because base64url (RFC 4648 §5) uses `-` and `_` as URL-safe replacements for `+` and `/`. The regex was chosen in 2021 on the understanding that GitHub tokens use only `[A-Za-z0-9_]` plus `.`.\n\n3. **Detection / mitigation in upstream platforms is unreliable.** GitHub Actions' built-in secret masker matches registered values as exact substrings. When the exception message is rendered by Symfony Console it may wrap, embed in `In BaseIO.php line N:` framing, or interleave with ANSI control sequences. So the masker does not redact, and the plaintext token reaches the log.","status":"published","published":"2026-05-19T16:17:58Z","modified":"2026-07-20T19:12:16Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:40:46.257074Z"}],"nvd":[{"id":"CVE-2026-45793","description":"Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\\IO\\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_\u003cid\u003e_\u003cbase64url-JWT\u003e format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.","status":"published","published":"2026-07-15T17:16:48.173Z","modified":"2026-07-15T20:54:43.733Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:29.879716Z"}],"osv":[{"id":"ALPINE-CVE-2026-45793","description":"Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\\IO\\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_\u003cid\u003e_\u003cbase64url-JWT\u003e format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.","status":"published","published":"2026-07-15T17:16:48.173Z","modified":"2026-11-03T06:32:55.940420774Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"CVE-2026-45793","title":"Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs","description":"Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\\IO\\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_\u003cid\u003e_\u003cbase64url-JWT\u003e format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.","status":"published","published":"2026-07-15T16:22:19.418Z","modified":"2026-10-28T02:30:38.86156741Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:45:05.525666Z"},{"id":"DEBIAN-CVE-2026-45793","description":"Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\\IO\\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_\u003cid\u003e_\u003cbase64url-JWT\u003e format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.","status":"published","published":"2026-07-15T17:16:48.173Z","modified":"2026-10-01T03:03:23.769183687Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"GHSA-f9f8-rm49-7jv2","title":"Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs","description":"### Summary\n\nComposer leaks the full contents of tokens configured as GitHub OAuth tokens if they do not match Composer's expected format for such tokens to stderr. GitHub has introduced a new format for GitHub Actions GITHUB_TOKEN values. These tokens are validated in the same way by Composer on GitHub Actions. The new format including a `-` (hyphen) fails Composer's validation and leads to disclosure of the GITHUB_TOKEN in logs.\n\nMany widely-used Actions (e.g. `shivammathur/setup-php`) auto-register `GITHUB_TOKEN` into composer's global `auth.json`, so the leak triggers without any unusual user configuration.\n\nGitHub Actions tokens expire when the associated job finishes, and they are scoped to the respective repository only. So in most regular cases the Composer validation, which errors while leaking the token, also immediately ends the job, expiring the token immediately. Tokens expire at the very latest after 6 hours on GitHub-hosted runners. If you use self-hosted runner, expiration is at most 24 hours after creation. The new token format is being rolled out gradually, so not all repositories are affected yet, but will be soon.\n\nClassic `ghp_` PATs are not affected by the regex bug per se, but the same leak primitive applies to any future credential that fails validation for any reason.\n\n### Details\n\nWhen a GitHub token fails regular expression validation of the character set, the rejected token is interpolated verbatim into the `UnexpectedValueException` message thrown by `Composer\\IO\\BaseIO::loadConfiguration()`, which Symfony Console then prints. Validation reliably fails for any token containing a `-` (hyphen), which includes the modern `ghs_\u003cid\u003e_\u003cbase64url-JWT\u003e` GitHub App installation token format, the same format used by GitHub Actions' built-in `GITHUB_TOKEN` and by `actions/create-github-app-token`. \n\nSeverity: medium. Pre-conditions are common in real-world CI. Practical blast radius is bounded by the leaked credential's scope and TTL (short for a workflow `GITHUB_TOKEN`, longer for App-minted tokens or user-issued credentials that happen to contain `-`).\n\nVulnerable code, `src/Composer/IO/BaseIO.php` (line 139 on `main`, line 143 on 2.8.x), inside `loadConfiguration()`:\n\n```php\n// allowed chars for GH tokens are from https://github.blog/changelog/2021-03-04-authentication-token-format-updates/\n// plus dots which were at some point used for GH app integration tokens\nif (!Preg::isMatch('{^[.A-Za-z0-9_]+$}', $token)) {\n    throw new \\UnexpectedValueException(\n        'Your github oauth token for '.$domain.' contains invalid characters: \"'.$token.'\"'\n    );\n}\n```\n\nThree issues combine to produce the leak:\n\n1. **The rejected token is interpolated into the exception message.** The exception bubbles up to Symfony Console's default error renderer, which writes it to stderr. Any environment that captures stderr (CI logs, log shippers, monitoring, support transcripts) now has the raw token.\n\n2. **The validation regex `^[.A-Za-z0-9_]+$` does not permit `-`.** GitHub's current `ghs_\u003cnumeric-id\u003e_\u003cbase64url-JWT\u003e` structured installation tokens routinely contain `-`, because base64url (RFC 4648 §5) uses `-` and `_` as URL-safe replacements for `+` and `/`. The regex was chosen in 2021 on the understanding that GitHub tokens use only `[A-Za-z0-9_]` plus `.`.\n\n3. **Detection / mitigation in upstream platforms is unreliable.** GitHub Actions' built-in secret masker matches registered values as exact substrings. When the exception message is rendered by Symfony Console it may wrap, embed in `In BaseIO.php line N:` framing, or interleave with ANSI control sequences. So the masker does not redact, and the plaintext token reaches the log.","status":"published","published":"2026-05-19T16:17:58Z","modified":"2026-07-20T21:26:45.76382392Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:46.39441Z"},{"id":"UBUNTU-CVE-2026-45793","description":"Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\\IO\\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_\u003cid\u003e_\u003cbase64url-JWT\u003e format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.","status":"published","published":"2026-07-15T17:16:00Z","modified":"2026-07-22T11:39:12.670311042Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:26.396868Z"},{"id":"BIT-composer-2026-45793","title":"Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs","description":"Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\\IO\\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_\u003cid\u003e_\u003cbase64url-JWT\u003e format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.","status":"published","published":"2026-07-20T20:36:59.69Z","modified":"2026-07-20T21:26:45.76382392Z","updated_at":"2026-11-02T15:28:28.70813Z"},{"id":"openSUSE-SU-2026:11300-1","title":"php-composer2-2.10.2-2.1 on GA media","description":"These are all security issues fixed in the php-composer2-2.10.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-17T00:00:00Z","modified":"2026-07-18T08:45:07.280205571Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21520-1","title":"Security update for php-composer2","description":"This update for php-composer2 fixes the following issues:\n\n- CVE-2026-45793: Github Actions issued `GITHUB_TOKEN` disclosure in GitHub Actions logs (bsc#1271504).\n- CVE-2026-59946: path traversal in package `bin` field lets dependencies `chmod` arbitrary host files (bsc#1271151).\n- CVE-2026-59947: URL-embedded HTTP-Basic username leaks to verbose logs  (bsc#1271129).\n- CVE-2026-59948: arbitrary file write outside `vendor`directory via malicious transitive package name (bsc#1271122).\n\nChanges for php-composer2:\n\n- fix byte-swapped signature on s390x can cause broken or unsupported signature (bsc#1271729).\n","status":"published","published":"2026-08-03T21:09:33Z","modified":"2026-08-04T18:30:06.533473107Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:21970-1","title":"Security update for php-composer2","description":"This update for php-composer2 fixes the following issues:\n\n- CVE-2026-59944: path traversal and link following issue can make files world readable and executable (bsc#1279898).\n","status":"published","published":"2026-09-29T14:57:30Z","modified":"2026-10-01T18:23:09.935082881Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23116-1","title":"Security update for php-composer2","description":"This update for php-composer2 fixes the following issues:\n\n- CVE-2026-45793: Github Actions issued `GITHUB_TOKEN` disclosure in GitHub Actions logs (bsc#1271504).\n- CVE-2026-59946: path traversal in package `bin` field lets dependencies `chmod` arbitrary host files (bsc#1271151).\n- CVE-2026-59947: URL-embedded HTTP-Basic username leaks to verbose logs  (bsc#1271129).\n- CVE-2026-59948: arbitrary file write outside `vendor`directory via malicious transitive package name (bsc#1271122).\n\nChanges for php-composer2:\n\n- fix byte-swapped signature on s390x can cause broken or unsupported signature (bsc#1271729).\n","status":"published","published":"2026-08-03T21:09:28Z","modified":"2026-08-14T18:23:44.579269455Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23138-1","title":"Security update for php-composer2","description":"This update for php-composer2 fixes the following issues:\n\n- CVE-2026-45793: Github Actions issued `GITHUB_TOKEN` disclosure in GitHub Actions logs (bsc#1271504).\n- CVE-2026-59946: path traversal in package `bin` field lets dependencies `chmod` arbitrary host files (bsc#1271151).\n- CVE-2026-59947: URL-embedded HTTP-Basic username leaks to verbose logs  (bsc#1271129).\n- CVE-2026-59948: arbitrary file write outside `vendor`directory via malicious transitive package name (bsc#1271122).\n\nChanges for php-composer2:\n\n- fix byte-swapped signature on s390x can cause broken or unsupported signature (bsc#1271729).\n","status":"published","published":"2026-08-03T21:09:28Z","modified":"2026-08-14T18:23:45.792589446Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23943-1","title":"Security update for php-composer2","description":"This update for php-composer2 fixes the following issues:\n\n- CVE-2026-59944: path traversal and link following issue can make files world readable and executable (bsc#1279898).\n","status":"published","published":"2026-09-29T14:45:31Z","modified":"2026-10-02T18:23:11.013872944Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3105-1","title":"Security update for php-composer2","description":"This update for php-composer2 fixes the following issues:\n\n- CVE-2026-45793: Github Actions issued `GITHUB_TOKEN` disclosure in GitHub Actions logs (bsc#1271504).\n- CVE-2026-59946: path traversal in package `bin` field lets dependencies `chmod` arbitrary host files (bsc#1271151).\n- CVE-2026-59947: URL-embedded HTTP-Basic username leaks to verbose logs  (bsc#1271129).\n- CVE-2026-59948: arbitrary file write outside `vendor`directory via malicious transitive package name (bsc#1271122).\n","status":"published","published":"2026-07-17T13:32:56Z","modified":"2026-07-18T08:45:10.042125924Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:4283-1","title":"Security update for php-composer2","description":"This update for php-composer2 fixes the following issues:\n\n- CVE-2026-45793: GitHub OAuth tokens failing regex validation can cause credential disclosure (bsc#1271504).\n- CVE-2026-59944: path traversal and link following issue can make files world readable and executable (bsc#1279898).\n- CVE-2026-59946: package bin entries with path segments can cause unintended host file permission modifications\n  (bsc#1271152).\n- CVE-2026-59947: unsanitized URL credential handling in debug output within Composer can allow sensitive token\n  disclosure (bsc#1271130).\n- CVE-2026-59948: missing package name validation during dependency resolution in Composer can allow path traversal\n  (bsc#1271123).\n- CVE-2026-84361: arbitrary code execution via malicious Perforce source URL (bsc#1278257).\n\nChanges for php-composer2:\n\n- version update to 2.2.30:\n\n * Fixed command injection via malicious Perforce url (GHSA-rvx4-ffvw-m9q3)\n * Sanitize URL-embedded usernames/token in a few more places (#13045)\n * Fixed matching of gitlab URLs to avoid possible credential leak to the wrong domain (#13042)\n  \n- fix a regression on s390x due last change (bsc#1271729).\n\n- version update to 2.2.29:\n\n * Validate package names (GHSA-499r-g7pc-vmp9)\n * Validate package bin paths against path traversal (GHSA-gjfg-22fp-rrxx)\n * Sanitize URL-embedded usernames/token in verbose output (GHSA-g6xq-892h-64w3)\n * Only follow HTTP redirects from HTTP responses (#12948)\n * Prevent phar metadata unserialization on unsafe PHP versions (#12946)\n * Sanitize JSON parse errors in http responses to avoid leaking response body data (#12959)\n * Fixed GitHub token validation to be even more relaxed (#12856)\n  \n- version update to 2.2.28.\n","status":"published","published":"2026-09-22T08:35:35Z","modified":"2026-09-23T09:15:06.105248697Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4288-1","title":"Security update for php-composer2","description":"This update for php-composer2 fixes the following issues:\n\n- CVE-2026-59944: path traversal and link following issue can make files world readable and executable (bsc#1279898).\n","status":"published","published":"2026-09-22T16:09:53Z","modified":"2026-09-23T09:15:06.102842358Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}