Executive brief
Filament is a PHP admin panel builder used by Laravel developers to create administrative interfaces. A flaw in the app-based multi-factor authentication (MFA) challenge handling allows attackers with access to an account's initial password to skip the second authentication factor when recovery codes are enabled, potentially gaining unauthorized access to admin accounts and the sensitive data they control.
Technical details
The vulnerability is an authentication bypass in Filament's MFA challenge handling mechanism. Specifically, when app-based multi-factor authentication is enabled alongside recovery codes, a flaw in how the challenge is validated permits an attacker to skip the second authentication factor. The attack requires low privileges (an authenticated user or network access to the login mechanism) and no user interaction once the initial credential is compromised. The vulnerability does not affect email-based MFA implementations. Patches are available in Filament 4.12.0 and 5.7.0, addressing versions 4.0.0–4.11.x and 5.0.0–5.6.x respectively.
Affected products
- Filament Filament 4.0.0 to 4.11.x, 5.0.0 to 5.6.x
Timeline
- 2026-08-17: disclosed
- 2026-08-17: patched: Patches released in versions 4.12.0 and 5.7.0
- 2026-09-01: advisory