CVE-2025-67507

Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.3.0 contain a flaw in the handling of recovery codes for app-based multi-factor authentication, allowing the same recovery code to be reused indefinitely. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. This issue is fixed in version 4.3.1.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/filamentphp/filament/commit/87ff60ad9b6e16d4e14ee36a220b8917dd7b0815	Patch
https://github.com/filamentphp/filament/security/advisories/GHSA-pvcv-q3q7-266g	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:filamentphp:filament:*:*:*:*:*:*:*:*

History

14 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Filament es una colección de componentes full-stack para el desarrollo acelerado de Laravel. Las versiones 4.0.0 a 4.3.0 contienen una falla en el manejo de los códigos de recuperación para la autenticación multifactor basada en aplicación, permitiendo que el mismo código de recuperación sea reutilizado indefinidamente. Este problema no afecta la MFA basada en correo electrónico. También solo se aplica cuando los códigos de recuperación están habilitados. Este problema está corregido en la versión 4.3.1.

Information

Published : 2025-12-10 01:15

Updated : 2026-10-14 21:10

NVD link : CVE-2025-67507

Mitre link : CVE-2025-67507

CVE.ORG link : CVE-2025-67507

JSON object : View

Products Affected

filamentphp

filament

CWE

CWE-287

Improper Authentication

CWE-288

Authentication Bypass Using an Alternate Path or Channel

{"id": "CVE-2025-67507", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67507", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-10T15:26:20.803891Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "filamentphp", "product": "filament", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.3.1"}]}]}], "published": "2025-12-10T01:15:52.463", "references": [{"url": "https://github.com/filamentphp/filament/commit/87ff60ad9b6e16d4e14ee36a220b8917dd7b0815", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/filamentphp/filament/security/advisories/GHSA-pvcv-q3q7-266g", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-288"}]}], "descriptions": [{"lang": "en", "value": "Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.3.0 contain a flaw in the handling of recovery codes for app-based multi-factor authentication, allowing the same recovery code to be reused indefinitely. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. This issue is fixed in version 4.3.1."}, {"lang": "es", "value": "Filament es una colecci\u00f3n de componentes full-stack para el desarrollo acelerado de Laravel. Las versiones 4.0.0 a 4.3.0 contienen una falla en el manejo de los c\u00f3digos de recuperaci\u00f3n para la autenticaci\u00f3n multifactor basada en aplicaci\u00f3n, permitiendo que el mismo c\u00f3digo de recuperaci\u00f3n sea reutilizado indefinidamente. Este problema no afecta la MFA basada en correo electr\u00f3nico. Tambi\u00e9n solo se aplica cuando los c\u00f3digos de recuperaci\u00f3n est\u00e1n habilitados. Este problema est\u00e1 corregido en la versi\u00f3n 4.3.1."}], "lastModified": "2026-10-14T21:10:00.183", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:filamentphp:filament:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E486FAC6-9D19-414A-817D-E5F17FD6869A", "versionEndExcluding": "4.3.1", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}