CVE catalog

CVE-2026-45793

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and in

[CVE catalog]

Severity
High · CVSS 7.5
Published
Source
[NVD] · [CVE record]
EPSS
1.02% · Oct 25, 2026

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancomposersid2.10.3-1fixed
Debiancomposerforky2.10.3-1fixed
Debiancomposertrixie2.8.8-1+deb13u3fixed
Debiancomposerbookworm2.5.5-1+deb12u5fixed
Debiancomposerbookworm-security2.5.5-1+deb12u2vulnerable
Susephp-composer2linux enterprise server 16.02.8.9-160000.6.1fixed
Susephp-composer2linux enterprise server for sap applications 16.02.8.9-160000.6.1fixed
Opensusephp-composer2leap 16.02.8.9-160000.6.1fixed
Susephp-composer2linux enterprise high performance computing 15 sp4-espos2.2.30-150400.3.21.1fixed
Susephp-composer2linux enterprise high performance computing 15 sp4-ltss2.2.30-150400.3.21.1fixed
Susephp-composer2linux enterprise high performance computing 15 sp5-espos2.2.30-150400.3.21.1fixed
Susephp-composer2linux enterprise high performance computing 15 sp5-ltss2.2.30-150400.3.21.1fixed
Susephp-composer2linux enterprise server 15 sp4-ltss2.2.30-150400.3.21.1fixed
Susephp-composer2linux enterprise server 15 sp5-ltss2.2.30-150400.3.21.1fixed
Susephp-composer2linux enterprise server for sap applications 15 sp42.2.30-150400.3.21.1fixed
Susephp-composer2linux enterprise server for sap applications 15 sp52.2.30-150400.3.21.1fixed
Susephp-composer2linux enterprise module for web and scripting 15 sp72.6.4-150600.3.23.1fixed
Ubuntucomposerpro1.9.0-2vulnerable
Ubuntucomposerpro1.9.1-1vulnerable
Ubuntucomposerpro1.9.2-1vulnerable
Ubuntucomposerpro1.9.3-1vulnerable
Ubuntucomposerpro1.10.0-1vulnerable
Ubuntucomposerpro1.10.1-1vulnerable
Ubuntucomposerpro1.10.1-1ubuntu0.1~esm1vulnerable
Ubuntucomposerpro1.10.1-1ubuntu0.1~esm2vulnerable
Opensusephp-composer2tumbleweed2.10.2-2.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancomposersourcesid2.10.0-1not yet assignedNot reportedNot reported
Debiancomposersourceforky2.10.0-1not yet assignedNot reportedNot reported
Debiancomposersourcetrixie2.8.8-1+deb13u3not yet assignedNot reportedNot reported
Debiancomposersourcebookworm2.5.5-1+deb12u5not yet assignedNot reportedNot reported
Susephp-composer2rpmlinux enterprise server 16.02.8.9-160000.6.1Not reportedSUSE-SU-2026:23943-1Not reported
Susephp-composer2rpmlinux enterprise server for sap applications 16.02.8.9-160000.6.1Not reportedSUSE-SU-2026:23943-1Not reported
Opensusephp-composer2rpmleap 16.02.8.9-160000.6.1Not reportedOPENSUSE-SU-2026:21970-1Not reported
Susephp-composer2rpmlinux enterprise high performance computing 15 sp4-espos2.2.30-150400.3.21.1Not reportedSUSE-SU-2026:4283-1Not reported
Susephp-composer2rpmlinux enterprise high performance computing 15 sp4-ltss2.2.30-150400.3.21.1Not reportedSUSE-SU-2026:4283-1Not reported
Susephp-composer2rpmlinux enterprise high performance computing 15 sp5-espos2.2.30-150400.3.21.1Not reportedSUSE-SU-2026:4283-1Not reported
Susephp-composer2rpmlinux enterprise high performance computing 15 sp5-ltss2.2.30-150400.3.21.1Not reportedSUSE-SU-2026:4283-1Not reported
Susephp-composer2rpmlinux enterprise server 15 sp4-ltss2.2.30-150400.3.21.1Not reportedSUSE-SU-2026:4283-1Not reported
Susephp-composer2rpmlinux enterprise server 15 sp5-ltss2.2.30-150400.3.21.1Not reportedSUSE-SU-2026:4283-1Not reported
Susephp-composer2rpmlinux enterprise server for sap applications 15 sp42.2.30-150400.3.21.1Not reportedSUSE-SU-2026:4283-1Not reported
Susephp-composer2rpmlinux enterprise server for sap applications 15 sp52.2.30-150400.3.21.1Not reportedSUSE-SU-2026:4283-1Not reported
Susephp-composer2rpmlinux enterprise module for web and scripting 15 sp72.6.4-150600.3.23.1Not reportedSUSE-SU-2026:4288-1Not reported
Opensusephp-composer2rpmtumbleweed2.10.2-2.1Not reportedOPENSUSE-SU-2026:11300-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [composer]Affected
    Details (4)

    • 2.5.5-1+deb12u5 · all · bookworm

      Fixed · Fixed: 2.5.5-1+deb12u5

      nvd · composer · debian · bookworm; nvd · composer · debian · 12

    • 2.5.5-1+deb12u5 · all · bookworm

      Fixed · Fixed: 2.5.5-1+deb12u5

      nvd · composer · debian · bookworm; nvd · composer · debian · 12

    • 2.5.5-1+deb12u2 · all · bookworm-security

      Affected · Fixed: 2.5.5-1+deb12u5

      nvd · composer · debian · bookworm; nvd · composer · debian · 12

    • 2.5.5-1+deb12u2 · all · bookworm-security

      Affected · Fixed: 2.5.5-1+deb12u5

      nvd · composer · debian · bookworm; nvd · composer · debian · 12

[Debian 13 (Trixie)]

  • [composer]Fixed
    Details (2)

    • 2.8.8-1+deb13u3 · all · trixie

      Fixed · Fixed: 2.8.8-1+deb13u3

      nvd · composer · debian · 13

    • 2.8.8-1+deb13u3 · all · trixie

      Fixed · Fixed: 2.8.8-1+deb13u3

      nvd · composer · debian · 13

[openSUSE Tumbleweed]

  • [php-composer2]Fixed

    Source package: [php-composer2]

    Details (1)

    • 2.10.3-1.1 · noarch · tumbleweed

      Fixed · Fixed: 2.10.2-2.1

      nvd · php-composer2 · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]