Is CVE-2026-77567 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77567 being exploited in the wild.

How severe is CVE-2026-77567?

High severity, with a CVSS score of 8.1, published 24 August 2026.

Which products and versions are affected?

Filament 4.0.0 to 4.11.x, 5.0.0 to 5.6.x; filament/filament (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=4.12.0.

Is there a fix for CVE-2026-77567?

Yes. filament/filament (Packagist): upgrade to 4.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77567 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-77567?

Check whether you run Filament or filament/filament (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77567: Filament multi-factor authentication bypass in app-based MFA

CVE-2026-77567 · Severity: high · CVSS 8.1 · Published 2026-08-24

Filament is a PHP admin panel builder used by Laravel developers to create administrative interfaces. A flaw in the app-based multi-factor authentication (MFA) challenge handling allows attackers with access to an account's initial password to skip the second authentication factor when recovery codes are enabled, potentially gaining unauthorized access to admin accounts and the sensitive data they control.

Technologies: Filament, filament/filament (Packagist). Vendors: Filament, Packagist.

Quick answers

Is CVE-2026-77567 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77567 being exploited in the wild.
How severe is CVE-2026-77567?: High severity, with a CVSS score of 8.1, published 24 August 2026.
Which products and versions are affected?: Filament 4.0.0 to 4.11.x, 5.0.0 to 5.6.x; filament/filament (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=4.12.0.
Is there a fix for CVE-2026-77567?: Yes. filament/filament (Packagist): upgrade to 4.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77567 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-77567?: Check whether you run Filament or filament/filament (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

filament/filament (Packagist): upgrade to 4.12.0 or later
```
composer require filament/filament:^4.12.0
```

Technical details

The vulnerability is an authentication bypass in Filament's MFA challenge handling mechanism. Specifically, when app-based multi-factor authentication is enabled alongside recovery codes, a flaw in how the challenge is validated permits an attacker to skip the second authentication factor. The attack requires low privileges (an authenticated user or network access to the login mechanism) and no user interaction once the initial credential is compromised. The vulnerability does not affect email-based MFA implementations. Patches are available in Filament 4.12.0 and 5.7.0, addressing versions 4.0.0–4.11.x and 5.0.0–5.6.x respectively.

Affected products

Filament Filament 4.0.0 to 4.11.x, 5.0.0 to 5.6.x

Identifiers

CVE-2026-77567
GHSA-52xp-w8hr-xv3c

Timeline

2026-08-17: disclosed
2026-08-17: patched: Patches released in versions 4.12.0 and 5.7.0
2026-09-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.