Flaw in Multi-Factor Authentication Recovery Codes in Filament Affects Laravel Development
CVE-2026-48505

7.4HIGH

Key Information:

Vendor

FilamentPHP

Status
Filament
Vendor
CVE Published:
22 June 2026

What is CVE-2026-48505?

Filament is a set of components designed for streamlined Laravel development. A vulnerability exists in versions 4.0.0 through 4.11.5 and 5.6.5, whereby the same recovery codes can be reused through concurrent submissions after user authentication. This flaw poses a risk when recovery codes are active, as it permits attackers who have access to both a user's password and their recovery codes to establish multiple authenticated sessions. This effectively bypasses the intended single-use nature of recovery codes, increasing the exposure window for potential unauthorized access.

Affected Version(s)

filament >= 4.0.0, < 4.11.5 < 4.0.0, 4.11.5

filament >= 5.0.0, < 5.6.5 < 5.0.0, 5.6.5

References

https://github.com/filamentphp/filament/security/advisori...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.