Search: CVE-2026-59947

Composer versions prior to 2.2.29 and 2.10.2 may leak HTTP Basic authentication credentials embedded in URLs to verbose debug logs when run with -vvv verbosity. This includes sensitive tokens such as GitHub Personal Access Tokens in the username portion of repository or package URLs. The issue arises because certain components did not sanitize username-only credentials in URLs before logging. Fixed versions 2.2.29 and 2.10.2 address this by properly sanitizing such credentials in debug output.