CVE-2026-59947: Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
When Composer is run with -vvv (debug verbosity), it could print a credential that was embedded directly in a repository or package URL, but not as a password, to its debug output. Composer already masked the password portion of such URLs, but the username portion was shown in clear text. Because GitHub and several other services support placing an access token in the username position of a URL (for example https://[token]@github.com/owner/repo), a token used that way could end up written to the verbose log in full.
This is an information disclosure issue. The credential is only ever exposed to whoever can already read Composer’s debug output.
References
- github.com/advisories/GHSA-g6xq-892h-64w3
- github.com/composer/composer/commit/6bd66874ae523ecb69aca5964487a0cdfda03ef8
- github.com/composer/composer/commit/8887ad76fbd830cb1861a2b1fd8ead78ed1fa1ec
- github.com/composer/composer/releases/tag/2.10.2
- github.com/composer/composer/releases/tag/2.2.29
- github.com/composer/composer/security/advisories/GHSA-g6xq-892h-64w3
- nvd.nist.gov/vuln/detail/CVE-2026-59947
Code Behaviors & Features
Detect and mitigate CVE-2026-59947 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →