CVE-2026-45793

HIGH

Composer: Github Actions issued GITHUB_TOKEN disclosure in GitHub Actions logs

Title source: cna
STIX 2.1

Description

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.

References (9)

Core 9
Core References
X_Refsource_Misc x_refsource_misc
https://github.com/composer/composer/pull/12853
X_Refsource_Misc x_refsource_misc
https://github.com/composer/composer/pull/12855

Scores

CVSS v3 7.5
EPSS 0.0080
EPSS Percentile 52.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (6)
composer/composer 1.0 - 1.10.28Packagist
composer/composer 2.0.0 - 2.2.28Packagist
composer/composer 2.3.0 - 2.9.8Packagist
composer/composer >= 1.0, < 1.10.28
composer/composer >= 2.0.0, < 2.2.28
composer/composer >= 2.3.0, < 2.9.8
Published Jul 15, 2026
Tracked Since Jul 15, 2026