CVE-2026-59947 MEDIUM

CVE-2026-59947: Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)

Vendor Composer
Product composer
Weakness CWE-532 · Sensitive info in logs
Published July 8, 2026
Last update July 8, 2026
View on NVD All CVEs

CVSS base score

4.7/10
Attack vector Local
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.

Key dates

02Disclosure timeline

July 8, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2021-25009 CorreosExpress <= 2.6.0 - Sensitive Information Disclosure CVE-2024-34798 WordPress Debug Log – Manger Tool plugin <= 1.4.5 - Sensitive Data Exposure vulnerability CVE-2024-31247 WordPress FG Drupal to WordPress plugin <= 3.70.3 - Sensitive Data Exposure via Log File vulnerability CVE-2024-31353 WordPress Slideshow Gallery LITE plugin <= 1.7.8 - Sensitive Data Exposure vulnerability CVE-2025-10486 Content Writer <= 3.6.8 - Unauthenticated Information Exposure via Log File