CVE-2026-104181
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In Filament (full-stack components for Laravel) versions from 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication (MFA) management actions do not consistently require confirmation of the current password. An attacker with access to an authenticated user session can set up app-based MFA and obtain recovery codes, or disable app-based MFA and regenerate recovery codes by supplying an existing app code or recovery code, without knowing the account password. Email-based MFA is not affected, and the issue does not independently permit an unauthenticated sign-in, but changing the app-MFA configuration may lock the legitimate user out.
Risk Assessment
An attacker who hijacks a user session can alter MFA configuration and lock out the legitimate user or obtain recovery codes, leading to loss of account control. This impacts confidentiality and availability of accounts in Laravel applications using Filament.
Recommendation
Update Filament to version 4.13.3 or 5.8.3 (or later) to fix the vulnerability. Additionally, consider enforcing password confirmation for MFA configuration changes and monitoring for unusual MFA setting modifications.
Other vulnerabilities in Filament
See all- CVE-2026-84307Low
Filament (a collection of full-stack components for Laravel) has a vulnerability in Login.php where the MFA challenge is presented before evaluating canAccessPanel(). For an account that canAccessPanel() denies, a correct password renders the MFA challenge while an incorrect password returns a generic authentication failure, allowing an unauthenticated attacker to confirm whether a candidate password is valid.
- CVE-2026-84306Medium
A vulnerability in Filament (a collection of components for Laravel) in versions from 4.0.0 to 4.12.6 and 5.7.6 allows reuse of a previously issued app-based MFA code even after a newer code has been used, for approximately four minutes, enabling an attacker with the password and one MFA code to access the account.
- CVE-2026-77567High
Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected.
- CVE-2026-55409High
Filament is a collection of components for accelerated Laravel development. From versions 3.0.0 to 3.3.53, a disabled RichEditor field rendered its raw state without sanitizing HTML, allowing attackers to inject malicious HTML or JavaScript, leading to XSS.
- CVE-2026-48505High
In versions 4.0.0 to 4.11.5 and 5.6.5, Filament has a flaw in handling recovery codes for app-based multi-factor authentication that allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA and only applies when recovery codes are enabled.
- CVE-2026-48500Medium
Filament, a collection of components for accelerated Laravel development, has a vulnerability that allows unauthenticated users to upload files in certain forms, such as the login form. This could lead to unauthorized access to the application's temporary storage.
- CVE-2026-48166Medium
Filament, a collection of components for accelerated Laravel development, has a vulnerability in the login page from versions 4.0.0 to 4.11.5 and 5.6.5 that allows unauthenticated attackers to enumerate registered email addresses.
Original NVD description (English source)
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication management actions do not consistently require confirmation of the current password. An attacker with access to an authenticated user session can set up app-based MFA and obtain recovery codes, or disable app-based MFA and regenerate recovery codes by supplying an existing app code or recovery code, without knowing the account password. Email-based MFA is not affected, and the issue does not independently permit an unauthenticated sign-in, but changing the app-MFA configuration may lock the legitimate user out. This issue is fixed in versions 4.13.3 and 5.8.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS