Log in Start free

Vulnerability · Published Aug 24, 2026 · Assigned by GitHub_M

CVE-2026-77567Filament: App-based MFA can be bypassed when recovery codes are enabled

High 8.1

In plain English

A high-severity improper authentication in filament from filamentphp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.6%top 53.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected. This issue is fixed in versions 4.12.0 and 5.7.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistfilament/filament4.12.0GHSA-52xp-w8hr-xv3c
Packagistfilament/filament5.7.0GHSA-52xp-w8hr-xv3c

Affected products (as reported)

VendorProductVersions
filamentphp filament >= 4.0.0, < 4.12.0>= 5.0.0, < 5.7.0

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References