CVE-2026-48505: Filament MFA recovery code reuse via concurrent submission

CVE-2026-48505 · Severity: high · CVSS 7.4 · Published 2026-06-22

A security flaw has been identified in Filament, a popular development framework for PHP applications. The issue affects the multi-factor authentication (MFA) system, specifically how it handles recovery codes used when a user loses access to their primary authentication device. If an attacker has already stolen a user's password and recovery codes, they can bypass the intended single-use restriction of those codes to create multiple unauthorized sessions simultaneously, potentially extending their access to sensitive business data.

Technologies: Filament, filament/filament (Packagist). Vendors: Filament, Packagist.

Quick answers

Is CVE-2026-48505 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48505 being exploited in the wild.
How severe is CVE-2026-48505?
High severity, with a CVSS score of 7.4, published 22 June 2026.
Which products and versions are affected?
Filament >= 4.0.0, < 4.11.5; >= 5.0.0, < 5.6.5; filament/filament (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=4.11.5.
Is there a fix for CVE-2026-48505?
Yes. filament/filament (Packagist): upgrade to 4.11.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48505 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48505?
Check whether you run Filament or filament/filament (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • filament/filament (Packagist): upgrade to 4.11.5 or later
    composer require filament/filament:^4.11.5

Technical details

A race condition (CWE-362) exists in Filament's app-based multi-factor authentication (MFA) recovery code validation logic. Due to improper synchronization during concurrent execution, an attacker can submit the same recovery code multiple times in parallel to bypass the single-use guarantee. This vulnerability requires the attacker to already possess the target user's password and recovery codes. Successful exploitation allows the creation of multiple authenticated sessions from a single recovery code, materially extending the attacker's window of access. The issue is fixed in versions 4.11.5 and 5.6.5.

Affected products

  • filamentphp filament >= 4.0.0, < 4.11.5; >= 5.0.0, < 5.6.5

Identifiers

  • CVE-2026-48505
  • GHSA-mc5j-f6wx-h9qh

Timeline

  • 2026-05-23: disclosed: Initial disclosure to vendor
  • 2026-06-22: advisory: NVD publication date
  • 2026-06-25: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.