Executive brief
Filament is a Laravel admin panel library used to build administrative dashboards for applications. A flaw in its app-based multi-factor authentication (MFA) system allows attackers who have obtained a user's password and a single one-time code to reuse that code multiple times within its validity window (approximately four minutes). This means an attacker can authenticate to user accounts even after the legitimate user has already logged in with a newer code, bypassing a critical security control.
Technical details
This vulnerability exists in Filament's app-based MFA implementation (CWE-294: Authentication Bypass by Capture-replay). The vulnerable component fails to properly invalidate previously issued one-time codes after a newer code from the same time window has been successfully authenticated. While duplicate submission of the exact same code was already blocked, any other code generated within the acceptance window remained valid. An attacker who obtains a user's password and intercepts or gains knowledge of a single TOTP code can replay that code to authenticate as the victim user for up to four minutes (default settings), even after the legitimate user has already used a subsequent code to log in. The attack requires prior compromise of both password and a single code, but no user interaction. Patches are available in Filament 4.12.6 and 5.7.6.
Affected products
- Filament Filament 4.0.0 to 4.12.5, 5.0.0 to 5.7.5
Timeline
- 2026-08-17: disclosed: Vulnerability published by GitHub Advisory Database
- 2026-08-17: patched: Patches released in Filament 4.12.6 and 5.7.6
- 2026-09-01: advisory: Advisory updated in GitHub Advisory Database