Filament: Multi-factor authentication (app) management actions do not require password reauthentication
App-based multi-factor authentication management actions did not consistently require the user to confirm their current password. In particular, an authenticated session could set up app-based MFA and obtain recovery codes without password reauthentication. Disabling app-based MFA and regenerating recovery codes also accepted an existing app code or recovery code without requiring the current password. This issue does not affect email-based MFA.
If an attacker gains access to a user's authenticated session, they could enable app-based MFA and obtain recovery codes without knowing the user's password, changing the account's MFA configuration and potentially locking the legitimate user out. This issue does not by itself allow an unauthenticated attacker to sign in.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | filament/filament | >= 4.0.0, < 4.13.3, >= 5.0.0, < 5.8.3 | 4.13.3, 5.8.3 |
Referencias
- https://github.com/filamentphp/filament/security/advisories/GHSA-7m6h-rg42-m449
- https://nvd.nist.gov/vuln/detail/CVE-2026-104181
- https://github.com/filamentphp/filament/pull/20522
- https://github.com/filamentphp/filament/commit/6d4dae6d7a94ce5aefd7ed4dc836acb0e6b71bb1
- https://github.com/filamentphp/filament
- https://github.com/filamentphp/filament/releases/tag/v4.13.3
- https://github.com/filamentphp/filament/releases/tag/v5.8.3
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L- Debilidad (CWE)
CWE-306- Plataforma
- Composer
- Paquete
filament/filament- Publicada
- 05.10.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-7m6h-rg42-m449 - CC BY 4.0
Historial de vulnerabilidades: filament/filament
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 8
- Primera → última
- 12.2025 10.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 3
- Media 4
- Baja 1
Divulgaciones por año
- 2025: 1
- 2026: 7
-
Filament: Multi-factor authentication (app) management actions do not require password reauthentication esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.