GitHub OAuth Token Validation Issue in Composer Dependency Manager
CVE-2026-45793
7.5HIGH
What is CVE-2026-45793?
Composer, a widely used dependency manager for PHP, had a vulnerability affecting its configuration loading method that incorrectly validated GitHub OAuth tokens. Specifically, tokens formatted as ghs__ could be rejected by the regex validation and inadvertently logged to stderr or continuous integration logs, potentially exposing sensitive information. This issue has been addressed in versions 1.10.28, 2.2.28, and 2.9.8, so users are encouraged to update their Composer installations to these versions to mitigate the risk.
Affected Version(s)
composer >= 1.0, < 1.10.28 < 1.0, 1.10.28
composer >= 2.0.0, < 2.2.28 < 2.0.0, 2.2.28
composer >= 2.3.0, < 2.9.8 < 2.3.0, 2.9.8