CVE-2026-45793: Composer Information Disclosure Flaw

CVE-2026-45793 Overview

CVE-2026-45793 is an information disclosure vulnerability in Composer, the dependency manager for the PHP language. The flaw resides in Composer\IO\BaseIO::loadConfiguration(), which validates GitHub OAuth tokens against the regex ^[.A-Za-z0-9_]+$. Tokens that fail this validation are interpolated directly into an UnexpectedValueException message. GitHub Actions GITHUB_TOKEN values using the newer ghs_<id>_<base64url-JWT> format contain hyphen characters, causing them to fail validation and be echoed to stderr or CI logs. This exposes sensitive authentication material to any party with access to build output. The issue is tracked under CWE-200: Exposure of Sensitive Information.

Critical Impact
Valid GitHub installation tokens can be leaked to CI logs and error streams, granting unauthorized access to repositories and workflows using the exposed credential.

Affected Products

Composer versions prior to 1.10.28
Composer versions prior to 2.2.28
Composer versions prior to 2.9.8

Discovery Timeline

2026-07-15 - CVE-2026-45793 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-45793

Vulnerability Analysis

The vulnerability stems from an overly restrictive token validation regex combined with unsafe error message construction. When Composer loads GitHub OAuth credentials, BaseIO::loadConfiguration() iterates through the configured tokens and validates each one against the pattern ^[.A-Za-z0-9_]+$. This character class does not include the hyphen (-) character.

GitHub Actions began issuing installation tokens in the ghs_<id>_<base64url-JWT> format. Base64url encoding uses - and _ as its non-alphanumeric characters. When such a token is provided to Composer, the regex fails and Composer raises an UnexpectedValueException containing the full token value in its message string. That exception message is written to standard error and captured by CI systems, exposing the token to log viewers and downstream artifact consumers.

Root Cause

Two defects combine to produce the disclosure. First, the validation regex ^[.A-Za-z0-9_]+$ in BaseIO.php and the GITHUB_TOKEN_REGEX constant in GitHub.php do not accommodate the hyphen character used in modern installation token formats. Second, the error handler in the rejection branch concatenates the raw token into the exception message rather than redacting it. The same oversight affects ProcessExecutor.php, where the credential-obfuscation routine also fails to match the new token shape when scrubbing debug command output.

Attack Vector

Exploitation is passive and occurs whenever a workflow configures Composer with a ghs_-prefixed installation token. Any actor with read access to the CI job logs, artifact bundles, or captured stderr streams can harvest the leaked token. Because GitHub installation tokens grant repository-scoped permissions, an attacker can reuse the disclosed credential to clone, modify, or publish code within the token's granted scope before it expires.

php

// Patched validation in src/Composer/IO/BaseIO.php
foreach ($githubOauth as $domain => $token) {
    // allowed chars for GH tokens are from https://github.blog/changelog/2021-03-04-authentication-token-format-updates/
    // plus dots which were at some point used for GH app integration tokens
-   if (!Preg::isMatch('{^[.A-Za-z0-9_]+$}', $token)) {
-       throw new \UnexpectedValueException('Your github oauth token for '.$domain.' contains invalid characters: "'.$token.'"');
+   if (!Preg::isMatch('{^[.A-Za-z0-9_-]+$}', $token)) {
+       throw new \UnexpectedValueException('Your github oauth token for '.$domain.' contains invalid characters.');
    }
    $this->checkAndSetAuthentication($domain, $token, 'x-oauth-basic');
}

Source: Composer commit 3f5e7f9

php

// Updated token regex in src/Composer/Util/GitHub.php
-public const GITHUB_TOKEN_REGEX = '{^([a-f0-9]{12,}|gh[a-z]_[a-zA-Z0-9_]+|github_pat_[a-zA-Z0-9_]+)$}';
+public const GITHUB_TOKEN_REGEX = '{^([a-f0-9]{12,}|gh[a-z]_[a-zA-Z0-9_.-]+|github_pat_[a-zA-Z0-9_]+)$}';

Source: Composer commit 3f5e7f9

Detection Methods for CVE-2026-45793

Indicators of Compromise

CI log entries containing the string Your github oauth token for followed by a token value beginning with ghs_.
UnexpectedValueException stack traces originating from Composer\IO\BaseIO::loadConfiguration() in build output.
Unexpected repository access events in GitHub audit logs from IP addresses that do not match the runner's expected egress range.

Detection Strategies

Scan historical CI logs and archived build artifacts for the specific exception phrase emitted by the vulnerable code path.
Inspect any log ingestion pipeline for strings matching the pattern ghs_[A-Za-z0-9_-]+ to identify inadvertently persisted tokens.
Correlate GitHub App installation token usage against the workflows and repositories authorized to consume them.

Monitoring Recommendations

Enable GitHub audit log streaming and alert on API calls authenticated by installation tokens outside of expected workflow windows.
Configure secret-scanning tools on log storage, artifact repositories, and issue trackers to catch leaked ghs_ credentials.
Track Composer version inventory across build agents to identify hosts still running versions predating the fix.

How to Mitigate CVE-2026-45793

Immediate Actions Required

Upgrade Composer to 1.10.28, 2.2.28, or 2.9.8 on all developer workstations, build agents, and container images.
Rotate any GitHub installation tokens that may have been passed to a vulnerable Composer version, particularly in CI pipelines.
Review CI logs for the exception signature and purge stored logs that contain exposed token material.

Patch Information

The Composer maintainers released fixes in v1.10.28, v2.2.28, and v2.9.8. The patches expand the token validation regex to include - and remove the raw token value from the resulting exception message. Additional adjustments in ProcessExecutor.php ensure debug-mode command logging redacts the new token format. Full remediation details are published in GitHub Security Advisory GHSA-f9f8-rm49-7jv2.

Workarounds

Avoid passing ghs_-prefixed GitHub Actions installation tokens to unpatched Composer versions; use classic personal access tokens or github_pat_ fine-grained tokens where possible.
Suppress or redact Composer stderr output in CI job configurations until the upgrade can be applied.
Restrict access to CI job logs and artifacts to a minimum set of trusted principals.

bash

# Upgrade Composer to a patched release
composer self-update 2.9.8

# Or pin to the appropriate branch fix
composer self-update 2.2.28
composer self-update 1.10.28

# Verify the installed version
composer --version