Multi-Factor Authentication Management Flaw in Filament by Laravel
CVE-2026-104181
5.4MEDIUM
What is CVE-2026-104181?
Filament, designed for accelerating Laravel app development, has a security issue where its multi-factor authentication (MFA) management actions do not consistently enforce the current password requirement. This flaw impacts versions 4.0.0 to 4.13.3 and 5.8.3. An authenticated attacker can manipulate MFA settings without needing the account password. This includes enabling MFA, acquiring recovery codes, or disabling MFA altogether, potentially locking legitimate users out of their accounts. This vulnerability does not affect email-based MFA, and the change does not allow unauthenticated sign-ins. The issue is resolved in versions 4.13.3 and 5.8.3.
Affected Version(s)
filament >= 4.0.0, < 4.13.2 < 4.0.0, 4.13.2
filament >= 5.0.0, < 5.8.2 < 5.0.0, 5.8.2