GitHub Advisoryadvisory · Packagist

GHSA-mc5j-f6wx-h9qh Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission

HIGH Published 2026-06-25 Modified 2026-06-25 Official page ↗
Aliases
CVE-2026-48505
Ecosystem
Packagist
Packages
filament/filament
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-362, CWE-841
Reviewed
2026-06-25

Affected packages

• Packagist filament/filament: >= 4.0.0, < 4.11.5 → fixed in 4.11.5 • Packagist filament/filament: >= 5.0.0, < 5.6.5 → fixed in 5.6.5

Description

A flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. If an attacker gains access to both the user's password and their recovery codes, they get two authenticated sessions per recovery code burned instead of one, or more if they batch the parallel submissions wider, materially extending the attacker's window of access compared to what the single-use guarantee implies.

Related

Alias · CVE (1)

  • CVE-2026-48505 Filament is a collection of full-stack components for accelerated Laravel development. vulnerability

Weakness · CWE (2)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
  • CWE-841 Improper Enforcement of Behavioral Workflow weakness

References