PHP Composer

CVE-2026-45793, PHP Composer: GitHub Actions and GitHub App installation tokens printed in full to CI job logs when GitHub's new token format failed validation (CVSS 7.5)

Composer validates configured GitHub tokens against an allowed character set in Composer\IO\BaseIO::loadConfiguration(); GitHub's new structured format for GitHub App installation tokens contains a hyphen, fails that check, and the resulting exception prints the full token to stderr, which CI captures in the job log, while GitHub Actions' secret masker may not redact it because the message is wrapped or framed (Packagist, 2026-05-13). Any workflow that configures a GitHub App installation token, including the auto-injected GITHUB_TOKEN, into Composer's auth and then runs any Composer command hits it, and actions such as shivammathur/setup-php register GITHUB_TOKEN automatically, so no unusual configuration is needed (Packagist, 2026-05-13). The advisory's header rates CVE-2026-45793 High 7.5 while its own text calls the severity medium, and it lists Composer from 2.3.0 before 2.9.8, from 2.0.0 before 2.2.28 and from 1.0 before 1.10.28 as affected, fixed in 2.9.8, 2.2.28 and 1.10.28 (Composer, 2026-05-13). CISA's Known Exploited Vulnerabilities catalogue did not list it as of 2026-10-21 (CISA KEV catalog, 2026-10-21).

The exposure window depends on the token: a hosted-runner GITHUB_TOKEN expires when the job ends or after six hours, and the error usually fails the job and expires it at once; on self-hosted runners it can stay valid for up to 24 hours after issuance; and tokens from actions/create-github-app-token or another GitHub App last up to an hour by default and can carry permissions broader than the workflow's own permissions: declaration (Packagist, 2026-05-13). GitHub rolled back the token change on 2026-05-13 at 14:30 UTC and planned to restart the rollout on 2026-05-18 after 14:00 UTC (Packagist, 2026-05-13).