Multi-Factor Authentication Vulnerability in Filament by Laravel

CVE-2025-67507

What is CVE-2025-67507?

Filament, a toolkit for speeding up Laravel development, has a notable issue where recovery codes for app-based multi-factor authentication can be reused indefinitely. This exposure arises specifically when recovery codes are enabled, compromising the security of user accounts. It is important to note that this flaw does not impact multi-factor authentication methods that utilize email. To mitigate this risk, users should update to version 4.3.1, where the vulnerability has been addressed effectively.

References