GHSA-5w46-g9pq-wh6f
Filament: Timing-based user enumeration on login page
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | filament/filament | >= 4.0.0, < 4.11.5 | 4.11.5 |
| Packagist | filament/filament | >= 5.0.0, < 5.6.5 | 5.6.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
The login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email addresses. The impact is limited to disclosing whether an account exists for a given email.
References
External links from the advisory. They lead to third-party sites.