Composer Debug Output Credential Exposure via URL

Executive Summary

CVE-2026-59947 is a vulnerability in Composer, a dependency manager for PHP, where authentication credentials embedded in the username part of a URL (such as a GitHub Personal Access Token in https://TOKEN@host/) were exposed in plaintext when Composer was run with very verbose debug output (-vvv). While passwords in URLs were masked, usernames were not, causing sensitive tokens to be printed in debug logs.

This happened because the components responsible for sanitizing URLs and debug output did not mask the username portion of URLs containing credentials. The issue was fixed by introducing a method that masks long tokens and certain sensitive usernames in debug output, preventing accidental exposure of these credentials.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the accidental exposure of sensitive authentication tokens or credentials embedded in URLs when running Composer with high debug verbosity (-vvv). If debug output is shared, logged, or stored insecurely, these tokens could be leaked to unauthorized parties.

Such exposure could allow attackers to misuse the leaked tokens to gain unauthorized access to repositories or services that the tokens protect, potentially compromising confidentiality.

However, this issue only affects users who embed credentials in URLs, run Composer with verbose debug output, and share or retain that output. The severity is rated as moderate with a CVSS score of 4.7.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if Composer is run with the -vvv (very verbose) debug verbosity and if debug output contains credentials embedded in the username portion of URLs, such as GitHub Personal Access Tokens in URLs like https://TOKEN@host/.

To detect this on your system, you can review Composer debug logs for any exposed tokens or credentials in URLs.

Suggested commands include running Composer commands with -vvv and inspecting the output for credential exposure, for example:

• composer update -vvv
• composer install -vvv

Then, carefully examine the debug output for any URLs containing tokens or credentials printed in plaintext.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate steps to mitigate this vulnerability include upgrading Composer to version 2.10.2 or 2.2.29 or later, where the issue has been fixed by masking usernames in URLs in debug output.

Additionally, avoid running Composer with the -vvv debug verbosity in environments where debug output is captured or shared, to prevent accidental exposure of credentials.

If upgrading immediately is not possible, ensure that debug logs are not stored or shared and remove any embedded credentials from URLs used in Composer configurations.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Composer (CVE-2026-59947) involves the exposure of sensitive credentials, such as GitHub Personal Access Tokens, in plaintext within verbose debug output. This exposure could lead to unauthorized access if debug logs are shared or retained improperly.

Such leakage of sensitive authentication tokens can impact compliance with data protection standards and regulations like GDPR and HIPAA, which require the protection of sensitive information and credentials to prevent unauthorized access and data breaches.

Therefore, if an organization uses vulnerable versions of Composer and runs it with high debug verbosity (-vvv), it risks inadvertently exposing sensitive credentials, potentially violating confidentiality requirements mandated by these regulations.

The issue has been fixed in Composer versions 2.2.29 and 2.10.2 by masking usernames in URLs in debug output, reducing the risk of such exposure and helping maintain compliance.

Useful 0 Not Useful 0