Summary

After a user changed their username, their personal Composer authentication token could keep working together with the previous username for up to 14 days, even after the token was regenerated.

Who was affected

Users of Private Packagist Cloud until the fix on October 16, 2026, and of Private Packagist Self-Hosted installations running a version before 2.0.38, if all of the following are true:

• The user's personal Composer authentication token was used with Composer, and within the next 14 days the user changed their username.
• After that, the token was regenerated, for example because it was exposed or because the organization requires tokens to expire, or the user turned off multi-factor authentication.

To use the previous token, an attacker needed a copy of it and had to know the user's previous username.

Impact

An attacker holding the user's previous token and knowing the user's previous username could have used them for up to 14 days after the username change to download the packages the user had access to. The previous token only worked for Composer downloads. It could not be used to log in or to change anything, and removing the user from an organization or a team still removed their access right away.

A user who turned off multi-factor authentication after changing their username could also have kept using Composer with their previous username for up to 14 days, even if their organization requires multi-factor authentication.

What we did

Changing a username now immediately invalidates the use of the personal Composer authentication token with the previous username. Tokens that were cached under a previous username before the fix stop working on their own within 14 days. The fix was deployed on Private Packagist Cloud on October 16, 2026, and released in Private Packagist Self-Hosted 2.0.38. We found this vulnerability during an internal security review.

Do customers need to do anything

• Private Packagist Self-Hosted: Upgrade to 2.0.38 or any later version. We recommend upgrading to the latest release.
• Private Packagist Cloud: No action is required.

All security advisories