CVE-2026-84307
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Filament (a collection of full-stack components for Laravel) has a vulnerability in Login.php where the MFA challenge is presented before evaluating canAccessPanel(). For an account that canAccessPanel() denies, a correct password renders the MFA challenge while an incorrect password returns a generic authentication failure, allowing an unauthenticated attacker to confirm whether a candidate password is valid.
Risk Assessment
An attacker can confirm the validity of passwords for accounts with MFA enabled that lack panel access, increasing the risk of brute-force or phishing attacks.
Recommendation
Update Filament to version 4.12.5 or 5.7.5, which contain the fix.
Other vulnerabilities in Filament
See all- CVE-2026-84306Medium
A vulnerability in Filament (a collection of components for Laravel) in versions from 4.0.0 to 4.12.6 and 5.7.6 allows reuse of a previously issued app-based MFA code even after a newer code has been used, for approximately four minutes, enabling an attacker with the password and one MFA code to access the account.
- CVE-2026-77567High
Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected.
- CVE-2026-55409High
Filament is a collection of components for accelerated Laravel development. From versions 3.0.0 to 3.3.53, a disabled RichEditor field rendered its raw state without sanitizing HTML, allowing attackers to inject malicious HTML or JavaScript, leading to XSS.
- CVE-2026-48505High
In versions 4.0.0 to 4.11.5 and 5.6.5, Filament has a flaw in handling recovery codes for app-based multi-factor authentication that allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA and only applies when recovery codes are enabled.
- CVE-2026-48500Medium
Filament, a collection of components for accelerated Laravel development, has a vulnerability that allows unauthenticated users to upload files in certain forms, such as the login form. This could lead to unauthorized access to the application's temporary storage.
- CVE-2026-48166Medium
Filament, a collection of components for accelerated Laravel development, has a vulnerability in the login page from versions 4.0.0 to 4.11.5 and 5.6.5 that allows unauthenticated attackers to enumerate registered email addresses.
Original NVD description (English source)
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel(). For an account that canAccessPanel() denies, submitting the correct password renders the MFA challenge while an incorrect password returns the generic authentication failure, allowing an unauthenticated attacker to confirm whether a candidate password is valid for that account. When email-based MFA is configured, the correct-password path also sends a login code to the account holder. The issue applies only to accounts that have MFA enabled and are denied panel access. Authentication is not bypassed because canAccessPanel() still runs after the challenge, and no session is created. This issue is fixed in versions 4.12.5 and 5.7.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS