Executive brief
Filament is a popular set of components for building administrative interfaces in PHP applications. A vulnerability in its login page allows unauthorized individuals to determine if a specific email address is registered in the system by measuring how long the server takes to respond. While this does not grant access to accounts, it can be used for targeted phishing or to identify users of a specific service.
Technical details
A timing-based user enumeration vulnerability (CWE-208) exists in the Filament login component. The root cause is an observable timing discrepancy during the authentication process, where the server's response time varies depending on whether a provided email address exists in the database. An unauthenticated remote attacker can exploit this by sending multiple login requests and analyzing response times to identify valid user accounts. This issue is resolved in versions 4.11.5 and 5.6.5.
Affected products
- filamentphp filament >= 4.0.0, <= 4.11.4
- filamentphp filament >= 5.0.0, <= 5.6.4
Timeline
- 2026-05-23: disclosed
- 2026-06-22: advisory: NVD publication date
- 2026-06-23: patched: GitHub Advisory published and reviewed