CVE-2026-84306 in Filament
Summary
by MITRE • 09/01/2026
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses AppAuthentication::verifyCode() with a used-code cache key derived from both the app authentication secret and the submitted TOTP code. This isolates the newest accepted timestep by code instead of by secret, allowing a previously issued app-based MFA code to be accepted after a newer code has already been used. Reuse of the exact same code was already prevented, but another code inside the accepted time window remained usable. An attacker who obtains the target account's password and one app-based MFA code can use that code for the remainder of the configured window, which is approximately four minutes with the default settings, even after the legitimate account holder logs in with a newer code. Email-based MFA is not affected. This issue is fixed in versions 4.12.6 and 5.7.6.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The vulnerability identified within Filament panels affects the multi-factor authentication implementation for app-based authenticators, specifically impacting versions from 4.0.0 through 4.12.6 and version 5.7.6 prior to its patching. This security flaw resides in the AppAuthentication::verifyCode method, which is responsible for validating Time-Based One-Time Passwords generated by mobile applications such as Google Authenticator or Authy. The core technical deficiency lies in how the system tracks used authentication codes to prevent replay attacks. Instead of maintaining a cache key that uniquely identifies each secret and its corresponding valid time step independently, the implementation derives the cache key from both the application authentication secret and the submitted TOTP code itself. This design choice creates a critical logical error where the tracking mechanism fails to isolate the accepted timestep by secret alone.
In standard Time-Based One-Time Password protocols, validity is determined by synchronizing the current time with the shared secret to generate a predictable sequence of codes. To prevent an attacker from reusing a captured code, systems typically cache the most recent valid time step associated with that specific user's secret. However, because Filament’s implementation ties the cache key to the specific code value rather than just the temporal window relative to the secret, it inadvertently allows for a race condition-like scenario where older codes remain viable if they fall within the same acceptable time window as newer ones. While the system correctly prevents the reuse of the exact identical string that was previously submitted, it fails to invalidate other distinct codes generated during the overlapping validity period. This means that any code produced by the authenticator app within approximately four minutes of a successfully used code remains valid for authentication purposes under default configurations.
The operational impact of this vulnerability is significant in scenarios where an attacker has compromised a user's password and manages to intercept or obtain at least one valid MFA code from their device, either through malware on the mobile device, shoulder surfing, or network interception if not properly secured. Once such a code is obtained, the attacker can use it for authentication throughout the remainder of the configured time window, even after the legitimate user has successfully logged in using a newer, different TOTP code generated moments later. This effectively extends the attack window beyond what was intended by the security model, allowing unauthorized access without requiring continuous real-time interception of codes. The vulnerability is specific to app-based MFA and does not affect email-based multi-factor authentication mechanisms, which utilize separate validation logic unaffected by this caching flaw.
From a classification perspective, this issue aligns with CWE-284 Improper Access Control, as the system fails to properly restrict access based on the temporal validity of credentials relative to the specific user secret. It also relates to CWE-613 Insufficient Session Expiration, in that the effective session or authentication state remains vulnerable due to improper management of credential lifecycle within a defined time window. In terms of MITRE ATT&CK framework mapping, this vulnerability facilitates Credential Access and Initial Access tactics by allowing an attacker who has obtained static credentials (password) and dynamic secrets (one-time codes) to maintain persistent access during the overlap period without detection or immediate session termination.
To mitigate this risk, organizations using affected versions must upgrade immediately to Filament version 4.12.6 or later for the v4 branch, or version 5.7.6 and above for the v5 branch. These releases correct the cache key derivation logic to ensure that each time step is uniquely tracked per secret, thereby invalidating all other codes within the window once one has been successfully authenticated. Until patching can be applied, administrators should consider enforcing stricter session timeouts or implementing additional monitoring for multiple concurrent authentication events from the same account within short intervals as a compensatory control. Regular security audits of third-party components and keeping dependencies updated are essential practices to prevent exploitation of such logical flaws in identity management systems.