Executive brief
A security flaw has been identified in Filament, a popular development framework for PHP applications. The issue affects the multi-factor authentication (MFA) system, specifically how it handles recovery codes used when a user loses access to their primary authentication device. If an attacker has already stolen a user's password and recovery codes, they can bypass the intended single-use restriction of those codes to create multiple unauthorized sessions simultaneously, potentially extending their access to sensitive business data.
Technical details
A race condition (CWE-362) exists in Filament's app-based multi-factor authentication (MFA) recovery code validation logic. Due to improper synchronization during concurrent execution, an attacker can submit the same recovery code multiple times in parallel to bypass the single-use guarantee. This vulnerability requires the attacker to already possess the target user's password and recovery codes. Successful exploitation allows the creation of multiple authenticated sessions from a single recovery code, materially extending the attacker's window of access. The issue is fixed in versions 4.11.5 and 5.6.5.
Affected products
- filamentphp filament >= 4.0.0, < 4.11.5; >= 5.0.0, < 5.6.5
Timeline
- 2026-05-23: disclosed: Initial disclosure to vendor
- 2026-06-22: advisory: NVD publication date
- 2026-06-25: advisory: GitHub Advisory published