# CVE-2026-77567: Filament multi-factor authentication bypass in app-based MFA

Source: https://junglewise.ai/threats/cve-2026-77567-filament-multi-factor-authentication-bypass-in-app-based-mfa  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77567 · Severity: high · CVSS 8.1 · Published 2026-08-24

Filament is a PHP admin panel builder used by Laravel developers to create administrative interfaces. A flaw in the app-based multi-factor authentication (MFA) challenge handling allows attackers with access to an account's initial password to skip the second authentication factor when recovery codes are enabled, potentially gaining unauthorized access to admin accounts and the sensitive data they control.

Technologies: [Filament](https://junglewise.ai/threats/technologies/filament), [filament/filament (Packagist)](https://junglewise.ai/threats/technologies/filament-filament). Vendors: [Filament](https://junglewise.ai/threats/vendors/filament), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-77567 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77567 being exploited in the wild.

**How severe is CVE-2026-77567?** High severity, with a CVSS score of 8.1, published 24 August 2026.

**Which products and versions are affected?** Filament 4.0.0 to 4.11.x, 5.0.0 to 5.6.x; filament/filament (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=4.12.0.

**Is there a fix for CVE-2026-77567?** Yes. filament/filament (Packagist): upgrade to 4.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77567 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-77567?** Check whether you run Filament or filament/filament (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- filament/filament (Packagist): upgrade to 4.12.0 or later

  ```sh
  composer require filament/filament:^4.12.0
  ```


## Technical details

The vulnerability is an authentication bypass in Filament's MFA challenge handling mechanism. Specifically, when app-based multi-factor authentication is enabled alongside recovery codes, a flaw in how the challenge is validated permits an attacker to skip the second authentication factor. The attack requires low privileges (an authenticated user or network access to the login mechanism) and no user interaction once the initial credential is compromised. The vulnerability does not affect email-based MFA implementations. Patches are available in Filament 4.12.0 and 5.7.0, addressing versions 4.0.0–4.11.x and 5.0.0–5.6.x respectively.

## Affected products

- Filament Filament 4.0.0 to 4.11.x, 5.0.0 to 5.6.x

## Identifiers

- CVE-2026-77567
- GHSA-52xp-w8hr-xv3c

## Timeline

- 2026-08-17: disclosed
- 2026-08-17: patched: Patches released in versions 4.12.0 and 5.7.0
- 2026-09-01: advisory

## References

- [https://api.github.com/users/Orrison](https://api.github.com/users/Orrison)
- [https://github.com/Orrison](https://github.com/Orrison)
- [https://api.github.com/users/Orrison/gists%7B/gist_id%7D](https://api.github.com/users/Orrison/gists%7B/gist_id%7D)
- [https://api.github.com/users/Orrison/repos](https://api.github.com/users/Orrison/repos)
- [https://avatars.githubusercontent.com/u/6799341?v=4](https://avatars.githubusercontent.com/u/6799341?v=4)
- [https://api.github.com/users/Orrison/events%7B/privacy%7D](https://api.github.com/users/Orrison/events%7B/privacy%7D)

## Related threats

- [Filament multi-factor authentication bypass without password](https://junglewise.ai/threats/cve-2026-104181-filament-is-a-collection-of-full-stack-components-for)
- [Filament password validity disclosure in login MFA](https://junglewise.ai/threats/cve-2026-84307-filament-password-validity-disclosure-in-login-mfa)
- [Filament app-based multi-factor authentication bypass via reused one-time codes](https://junglewise.ai/threats/cve-2026-84306-filament-app-based-multi-factor-authentication-bypass-via-reused)
- [Filament MFA recovery code reuse via concurrent submission](https://junglewise.ai/threats/cve-2026-48505-filament-mfa-recovery-code-reuse-via-concurrent-submission)
- [Filament unauthenticated temporary file upload in auth components](https://junglewise.ai/threats/cve-2026-48500-filament-unauthenticated-temporary-file-upload-in-auth-components)