CVE-2026-84306
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
A vulnerability in Filament (a collection of components for Laravel) in versions from 4.0.0 to 4.12.6 and 5.7.6 allows reuse of a previously issued app-based MFA code even after a newer code has been used, for approximately four minutes, enabling an attacker with the password and one MFA code to access the account.
Risk Assessment
The attack can lead to unauthorized access to user accounts, potentially resulting in data confidentiality and integrity breaches.
Recommendation
Update Filament to version 4.12.6 or 5.7.6, which contain the fix.
Other vulnerabilities in Filament
See all- CVE-2026-84307Low
Filament (a collection of full-stack components for Laravel) has a vulnerability in Login.php where the MFA challenge is presented before evaluating canAccessPanel(). For an account that canAccessPanel() denies, a correct password renders the MFA challenge while an incorrect password returns a generic authentication failure, allowing an unauthenticated attacker to confirm whether a candidate password is valid.
- CVE-2026-77567High
Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected.
- CVE-2026-55409High
Filament is a collection of components for accelerated Laravel development. From versions 3.0.0 to 3.3.53, a disabled RichEditor field rendered its raw state without sanitizing HTML, allowing attackers to inject malicious HTML or JavaScript, leading to XSS.
- CVE-2026-48505High
In versions 4.0.0 to 4.11.5 and 5.6.5, Filament has a flaw in handling recovery codes for app-based multi-factor authentication that allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA and only applies when recovery codes are enabled.
- CVE-2026-48500Medium
Filament, a collection of components for accelerated Laravel development, has a vulnerability that allows unauthenticated users to upload files in certain forms, such as the login form. This could lead to unauthorized access to the application's temporary storage.
- CVE-2026-48166Medium
Filament, a collection of components for accelerated Laravel development, has a vulnerability in the login page from versions 4.0.0 to 4.11.5 and 5.6.5 that allows unauthenticated attackers to enumerate registered email addresses.
Original NVD description (English source)
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses AppAuthentication::verifyCode() with a used-code cache key derived from both the app authentication secret and the submitted TOTP code. This isolates the newest accepted timestep by code instead of by secret, allowing a previously issued app-based MFA code to be accepted after a newer code has already been used. Reuse of the exact same code was already prevented, but another code inside the accepted time window remained usable. An attacker who obtains the target account's password and one app-based MFA code can use that code for the remainder of the configured window, which is approximately four minutes with the default settings, even after the legitimate account holder logs in with a newer code. Email-based MFA is not affected. This issue is fixed in versions 4.12.6 and 5.7.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS