Composer is a dependency manager for PHP. In Composer versions before 1.10.28, 2.2.28, and 2.9.8, the loadConfiguration() method validates GitHub OAuth tokens against the regex ^[.A-Za-z0-9_]+$ and, when a token fails validation, includes the rejected token in an UnexpectedValueException. GitHub Actions generates GITHUB_TOKEN values in the form ghs_<id>_<base64url-JWT>, which contain dash characters, causing the token to fail validation and be written to stderr or pipeline logs. This results in a privileged credential being exposed in CI logs. The vulnerability is resolved in the aforementioned Composer releases.

The flaw is present in Composer versions earlier than 1.10.28, 2.2.28, and 2.9.8. These versions are used broadly for dependency resolution in PHP projects that run within GitHub Actions workflows, so any project that relies on an outdated Composer binary in its CI pipeline is affected.

The CVSS score of 7.5 indicates medium‑to‑high severity, while the EPSS score of less than 1 % points to a very low yet non‑zero probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to obtain read access to CI logs – either through a repository’s log viewer permissions or by compromising the workflow runner environment – to harvest the leaked token. The attack vector is therefore local to the CI environment and does not involve remote code execution.