# CVE-2026-48505: Filament MFA recovery code reuse via concurrent submission

Source: https://junglewise.ai/threats/cve-2026-48505-filament-mfa-recovery-code-reuse-via-concurrent-submission  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-48505 · Severity: high · CVSS 7.4 · Published 2026-06-22

A security flaw has been identified in Filament, a popular development framework for PHP applications. The issue affects the multi-factor authentication (MFA) system, specifically how it handles recovery codes used when a user loses access to their primary authentication device. If an attacker has already stolen a user's password and recovery codes, they can bypass the intended single-use restriction of those codes to create multiple unauthorized sessions simultaneously, potentially extending their access to sensitive business data.

Technologies: [Filament](https://junglewise.ai/threats/technologies/filament), [filament/filament (Packagist)](https://junglewise.ai/threats/technologies/filament-filament). Vendors: [Filament](https://junglewise.ai/threats/vendors/filament), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-48505 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48505 being exploited in the wild.

**How severe is CVE-2026-48505?** High severity, with a CVSS score of 7.4, published 22 June 2026.

**Which products and versions are affected?** Filament >= 4.0.0, < 4.11.5; >= 5.0.0, < 5.6.5; filament/filament (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=4.11.5.

**Is there a fix for CVE-2026-48505?** Yes. filament/filament (Packagist): upgrade to 4.11.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48505 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48505?** Check whether you run Filament or filament/filament (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- filament/filament (Packagist): upgrade to 4.11.5 or later

  ```sh
  composer require filament/filament:^4.11.5
  ```


## Technical details

A race condition (CWE-362) exists in Filament's app-based multi-factor authentication (MFA) recovery code validation logic. Due to improper synchronization during concurrent execution, an attacker can submit the same recovery code multiple times in parallel to bypass the single-use guarantee. This vulnerability requires the attacker to already possess the target user's password and recovery codes. Successful exploitation allows the creation of multiple authenticated sessions from a single recovery code, materially extending the attacker's window of access. The issue is fixed in versions 4.11.5 and 5.6.5.

## Affected products

- filamentphp filament >= 4.0.0, < 4.11.5; >= 5.0.0, < 5.6.5

## Identifiers

- CVE-2026-48505
- GHSA-mc5j-f6wx-h9qh

## Timeline

- 2026-05-23: disclosed: Initial disclosure to vendor
- 2026-06-22: advisory: NVD publication date
- 2026-06-25: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/StarPlatinu](https://api.github.com/users/StarPlatinu)
- [https://github.com/StarPlatinu](https://github.com/StarPlatinu)
- [https://api.github.com/users/StarPlatinu/gists%7B/gist_id%7D](https://api.github.com/users/StarPlatinu/gists%7B/gist_id%7D)
- [https://api.github.com/users/StarPlatinu/repos](https://api.github.com/users/StarPlatinu/repos)
- [https://avatars.githubusercontent.com/u/72287279?v=4](https://avatars.githubusercontent.com/u/72287279?v=4)
- [https://api.github.com/users/StarPlatinu/events%7B/privacy%7D](https://api.github.com/users/StarPlatinu/events%7B/privacy%7D)

## Related threats

- [Filament multi-factor authentication bypass without password](https://junglewise.ai/threats/cve-2026-104181-filament-is-a-collection-of-full-stack-components-for)
- [Filament password validity disclosure in login MFA](https://junglewise.ai/threats/cve-2026-84307-filament-password-validity-disclosure-in-login-mfa)
- [Filament app-based multi-factor authentication bypass via reused one-time codes](https://junglewise.ai/threats/cve-2026-84306-filament-app-based-multi-factor-authentication-bypass-via-reused)
- [Filament multi-factor authentication bypass in app-based MFA](https://junglewise.ai/threats/cve-2026-77567-filament-multi-factor-authentication-bypass-in-app-based-mfa)
- [Filament unauthenticated temporary file upload in auth components](https://junglewise.ai/threats/cve-2026-48500-filament-unauthenticated-temporary-file-upload-in-auth-components)