Summary

The link to join a team and the links to log in or connect an account with an OAuth provider such as GitHub, GitLab or Bitbucket could be modified to send the user to an arbitrary external website after following it. The check that only allowed redirects to Private Packagist accepted some addresses that browsers resolve to another website.

Who was affected

Users of Private Packagist Cloud until the fix on October 14, 2026, and of Private Packagist Self-Hosted installations running a version before 2.0.38. An attacker had to send the modified link to the user through another channel, for example by email, and the user had to follow it and log in, connect the account or join the team.

Impact

An attacker could have sent users a modified link to join a team, to log in or to connect an account with an OAuth provider that starts with a Private Packagist address but would have sent the user to a website controlled by the attacker after following it, for example to make a phishing page look trustworthy. The link itself gave the attacker no access to Private Packagist, and did not reveal any data or credentials of the user to the attacker's website.

What we did

Links to join a team, to log in and to connect an account with an OAuth provider now only redirect to pages of Private Packagist. Addresses that browsers could resolve to another website are rejected, and the user is sent to the default page instead.

Do customers need to do anything

• Private Packagist Self-Hosted: Upgrade to 2.0.38 or any later version. We recommend upgrading to the latest release.
• Private Packagist Cloud: No action is required.

All security advisories