GitHub Advisoryadvisory · Packagist

GHSA-pvcv-q3q7-266g Filament multi-factor authentication (app) recovery codes can be used multiple times

HIGH Published 2025-12-09 Modified 2026-06-08 Official page ↗
Aliases
CVE-2025-67507
Ecosystem
Packagist
Packages
filament/filament
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287, CWE-288
Reviewed
2025-12-09

Affected packages

• Packagist filament/filament: >= 4.0.0, < 4.3.1 → fixed in 4.3.1

Description

A flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused indefinitely. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. If an attacker gains access to both the user's password and their recovery codes, they can repeatedly complete MFA without the user's app-based second factor. This weakens the expected security of MFA by turning recovery codes into a static, long-term bypass method.

Related

Alias · CVE (1)

  • CVE-2025-67507 Filament is a collection of full-stack components for accelerated Laravel development. vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness

References