Log in Start free

Vulnerability · Published Oct 1, 2026 · Assigned by GitHub_M

CVE-2026-104181Filament: Multi-factor authentication (app) management actions do not require password reauthentication

Medium 5.4

In plain English

A medium-severity missing authentication in filament from filamentphp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.3%top 71.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication management actions do not consistently require confirmation of the current password. An attacker with access to an authenticated user session can set up app-based MFA and obtain recovery codes, or disable app-based MFA and regenerate recovery codes by supplying an existing app code or recovery code, without knowing the account password. Email-based MFA is not affected, and the issue does not independently permit an unauthenticated sign-in, but changing the app-MFA configuration may lock the legitimate user out. This issue is fixed in versions 4.13.3 and 5.8.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistfilament/filament4.13.3GHSA-7m6h-rg42-m449
Packagistfilament/filament5.8.3GHSA-7m6h-rg42-m449

Affected products (as reported)

VendorProductVersions
filamentphp filament >= 4.0.0, < 4.13.2>= 5.0.0, < 5.8.2

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References