Findings

CVE-2026-64652

GitHub CLI partially discloses authentication tokens in output

Published Oct 15, 2026 · updated Oct 15, 2026

### Summary A security vulnerability has been identified in GitHub CLI where could potentially print a portion of the authentication token in plaintext, depending on the lexical structure of the token. Affected users: - Authenticated users who ran (without the flag) with a token type whose format contains an underscore after the prefix. This includes fine-grained personal access tokens ( ) and GitHub App installation/user access tokens ( , , e.g., ), including the Actions . Classic tokens such as and have an underscore-free body and are not affected. ### Details The vulnerability stems from the way GitHub CLI masks the authentication token when reporting authentication state: 1. A user runs without , expecting the token to be fully masked. 2. The masking logic redacts only the characters that follow the last underscore in the token, instead of redacting everything after the token prefix. 3. The partially masked token is written to the command output, where it can be captured or shared. Because is a diagnostic command commonly run interactively and inside automated environments, the leaked token characters can end up in CI/CD job logs, terminal scrollback, screen recordings, screenshots, or pasted output shared in bug reports and support requests. In , GitHub CLI fully masks the token in output, preserving only the known token prefix and redacting the remainder unless is explicitly provided. ### Impact Running in a context where the output is captured, logged, or shared could leak a portion of an affected token. The affected token types are fine-grained personal access tokens ( ) and GitHub App installation/user access tokens ( , , e.g., ), including the Actions . Installation and Actions tokens are short-lived, which narrows the window in which a recovered token could be reused. See [GitHub credential types](https://docs.github.com/en/organizations/managing-programmatic-access-to-your-organization/github-credential-types#credential-types-overview). ### Remediation a