Exposure of Credentials in Dependency Manager Versions by Composer
CVE-2026-59947

4.7MEDIUM

Key Information:

Vendor

Composer

Status
Composer
Vendor
CVE Published:
8 July 2026

What is CVE-2026-59947?

A vulnerability in Composer prior to versions 2.2.29 and 2.10.2 allows the exposure of sensitive credentials, such as Personal Access Tokens, in the debug output when the software is run with high verbosity settings. Due to insufficient sanitization of username-only URL credentials by the AuthHelper and related functions, embedded credentials can be printed in logs, posing a significant risk to user security. Users are urged to upgrade to the latest versions to mitigate this issue.

Affected Version(s)

composer >= 1.0, < 2.2.29 < 1.0, 2.2.29

composer >= 2.3.0, < 2.10.2 < 2.3.0, 2.10.2

References

https://github.com/composer/composer/security/advisories/...
x_refsource_CONFIRM
https://github.com/composer/composer/commit/6bd66874ae523...
x_refsource_MISC
https://github.com/composer/composer/commit/8887ad76fbd83...
x_refsource_MISC

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.