Composer, the dependency manager for PHP, contains a flaw that writes the username portion of a repository or package URL to verbose logs when the -vvv debug flag is enabled. If the URL embeds a GitHub Personal Access Token (PAT) in the form https://TOKEN@host/, the token appears in plain text in the log output. This is a direct information‑disclosure vulnerability (CWE‑532) that could expose private tokens to anyone who can read console output or stored logs, potentially granting unauthorized access to GitHub.

The issue exists in Composer releases older than 2.2.29 and 2.10.2. Any installation running an affected version with the -vvv debug flag is vulnerable. Upgrading to either 2.2.29 or the newer 2.10.2 branch removes the bug.

The CVSS score of 4.7 indicates medium impact limited to credential disclosure. The EPSS score of less than 1% suggests a very low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires local or shared access to Composer logs; an attacker reading the console or log files could capture the leaked PAT, which could then be used to obtain broader access if the token authorisation is wide.