CVE-2026-45793

score

0.1

cvss

7.5

epss

1.0%

published

2026-07-15

kev added

—

first seen

2026-10-21

Composer prior to 1.10.28, 2.2.28, and 2.9.8 contains an information disclosure vulnerability caused by improper validation of GitHub OAuth tokens in BaseIO::loadConfiguration(), letting attackers cause token leakage to stderr or CI logs, exploit requires use of GitHub Actions GITHUB_TOKEN with ghs_<id>_<base64url-JWT> format.