GHSA-xwpv-pqxp-5v36 Filament: Password validity disclosure for accounts denied panel access on login page

• Packagist filament/filament: >= 4.0.0, < 4.12.5 → fixed in 4.12.5 • Packagist filament/filament: >= 5.0.0, < 5.7.5 → fixed in 5.7.5

When multi-factor authentication is enabled, the login page presents the multi-factor challenge before evaluating `canAccessPanel()`. For an account that `canAccessPanel()` denies, submitting the correct password renders the challenge while an incorrect password returns the generic failure message, allowing an unauthenticated attacker to confirm that a password is valid for that account. When email-based multi-factor authentication is used, a login code is also sent to the account holder. This issue only applies to accounts that both have multi-factor authentication enabled and are denied by `canAccessPanel()`. Authentication is not bypassed as the check still runs after the challenge, and no session is created.