CVE-2026-77567

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected. This issue is fixed in versions 4.12.0 and 5.7.0.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/filamentphp/filament/commit/45534a6f87f50ac6df3b43680bb33f8da9ef207b
https://github.com/filamentphp/filament/releases/tag/v4.12.0
https://github.com/filamentphp/filament/releases/tag/v5.7.0
https://github.com/filamentphp/filament/security/advisories/GHSA-52xp-w8hr-xv3c

Configurations

No configuration.

History

12 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Filament es una colección de componentes full-stack para el desarrollo acelerado de Laravel. Antes de las versiones 4.12.0 y 5.7.0, el manejo incorrecto de los campos obligatorios del formulario de desafío permite que la autenticación multifactor basada en aplicación sea eludida cuyo los códigos de recuperación están habilitados. La autenticación multifactor basada en correo electrónico no se ve afectada. Este problema está solucionado en las versiones 4.12.0 y 5.7.0.

Information

Published : 2026-08-24 21:17

Updated : 2026-10-12 15:10

NVD link : CVE-2026-77567

Mitre link : CVE-2026-77567

CVE.ORG link : CVE-2026-77567

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-77567", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77567", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-27T14:17:17.322684Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "filamentphp", "product": "filament", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.12.0"}, {"status": "affected", "version": ">= 5.0.0, < 5.7.0"}]}]}], "published": "2026-08-24T21:17:48.150", "references": [{"url": "https://github.com/filamentphp/filament/commit/45534a6f87f50ac6df3b43680bb33f8da9ef207b", "source": "security-advisories@github.com"}, {"url": "https://github.com/filamentphp/filament/releases/tag/v4.12.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/filamentphp/filament/releases/tag/v5.7.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/filamentphp/filament/security/advisories/GHSA-52xp-w8hr-xv3c", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected. This issue is fixed in versions 4.12.0 and 5.7.0."}, {"lang": "es", "value": "Filament es una colecci\u00f3n de componentes full-stack para el desarrollo acelerado de Laravel. Antes de las versiones 4.12.0 y 5.7.0, el manejo incorrecto de los campos obligatorios del formulario de desaf\u00edo permite que la autenticaci\u00f3n multifactor basada en aplicaci\u00f3n sea eludida cuyo los c\u00f3digos de recuperaci\u00f3n est\u00e1n habilitados. La autenticaci\u00f3n multifactor basada en correo electr\u00f3nico no se ve afectada. Este problema est\u00e1 solucionado en las versiones 4.12.0 y 5.7.0."}], "lastModified": "2026-10-12T15:10:00.207", "sourceIdentifier": "security-advisories@github.com"}