~ / search / GHSA-7m6h-rg42-m449

GHSA-7m6h-rg42-m449

Filament: Multi-factor authentication (app) management actions do not require password reauthentication

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-104181

Packages

EcosystemPackageAffectedFixed in
Packagist filament/filament >= 4.0.0, < 4.13.3 4.13.3
Packagist filament/filament >= 5.0.0, < 5.8.3 5.8.3

Details

As written in the advisory (Markdown source, shown as plain text).

App-based multi-factor authentication management actions did not consistently require the user to confirm their current password. In particular, an authenticated session could set up app-based MFA and obtain recovery codes without password reauthentication. Disabling app-based MFA and regenerating recovery codes also accepted an existing app code or recovery code without requiring the current password. This issue does not affect email-based MFA. If an attacker gains access to a user's authenticated session, they could enable app-based MFA and obtain recovery codes without knowing the user's password, changing the account's MFA configuration and potentially locking the legitimate user out. This issue does not by itself allow an unauthenticated attacker to sign in.

References

External links from the advisory. They lead to third-party sites.