diff --git a/java/code/src/com/suse/manager/webui/controllers/DownloadController.java b/java/code/src/com/suse/manager/webui/controllers/DownloadController.java
index 4e1c105aa12..0521e97555f 100644
--- a/java/code/src/com/suse/manager/webui/controllers/DownloadController.java
+++ b/java/code/src/com/suse/manager/webui/controllers/DownloadController.java
@@ -592,8 +592,9 @@ else if (!onlyChannels.contains(channel)) {
                 halt(HttpStatus.SC_BAD_REQUEST, "Token does not specify the organization");
             }
             else if (!ChannelFactory.isAccessibleBy(channel, orgId)) {
-                LOG.info("Forbidden: Token does not provide access to channel {}", channel);
-                halt(HttpStatus.SC_FORBIDDEN, "Token does not provide access to channel %s".formatted(channel));
+                String sanitChannel = StringUtil.sanitizeLogInput(channel);
+                LOG.info("Forbidden: Token does not provide access to channel {}", sanitChannel);
+                halt(HttpStatus.SC_FORBIDDEN, "Token does not provide access to channel %s".formatted(sanitChannel));
             }
         }
         catch (TokenParsingException e) {