GitHub Advisoryadvisory · Packagist

GHSA-5w46-g9pq-wh6f Filament: Timing-based user enumeration on login page

MEDIUM Published 2026-06-23 Modified 2026-06-23 Official page ↗
Aliases
CVE-2026-48166
Ecosystem
Packagist
Packages
filament/filament
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-208
Reviewed
2026-06-23

Affected packages

• Packagist filament/filament: >= 4.0.0, < 4.11.5 → fixed in 4.11.5 • Packagist filament/filament: >= 5.0.0, < 5.6.5 → fixed in 5.6.5

Description

The login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email addresses. The impact is limited to disclosing whether an account exists for a given email.

Related

Alias · CVE (1)

  • CVE-2026-48166 Filament is a collection of full-stack components for accelerated Laravel development. vulnerability

Weakness · CWE (1)

  • CWE-208 Observable Timing Discrepancy weakness

References