BIT-composer-2026-59947

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/composer/BIT-composer-2026-59947.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-composer-2026-59947
Aliases
Published
2026-07-14T08:40:59.896Z
Modified
2026-07-14T10:11:18.343666196Z
Summary
Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
Details

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a repository or package URL, such as a GitHub Personal Access Token in https://TOKEN@host/, to debug output because AuthHelper, Url::sanitize, and ProcessExecutor did not sanitize username-only URL credentials. This issue is fixed in versions 2.2.29 and 2.10.2.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:getcomposer:composer:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}
References

Affected packages

Bitnami / composer

Package

Name
composer
Purl
pkg:bitnami/composer

Severity

  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
1.0.0
Fixed
2.2.29
Introduced
2.3.0
Fixed
2.10.2

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/composer/BIT-composer-2026-59947.json"