filamentphp filament up to 4.11.4/5.6.4 race condition

Summaryinfo

A vulnerability identified as problematic has been detected in filamentphp filament up to 4.11.4/5.6.4. The affected element is an unknown function. This manipulation causes race condition. The identification of this vulnerability is CVE-2026-48505. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in filamentphp filament up to 4.11.4/5.6.4 and classified as problematic. Affected by this vulnerability is some unknown functionality. The manipulation with an unknown input leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, a flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. If an attacker gains access to both the user's password and their recovery codes, they get two authenticated sessions per recovery code burned instead of one, or more if they batch the parallel submissions wider, materially extending the attacker's window of access compared to what the single-use guarantee implies. This vulnerability is fixed in 4.11.5 and 5.6.5.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-48505 since 05/21/2026. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available.

Upgrading to version 4.11.5 or 5.6.5 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• filamentphp

Name

• filament

Version

• 4.11.0
• 4.11.1
• 4.11.2
• 4.11.3
• 4.11.4
• 5.6.0
• 5.6.1
• 5.6.2
• 5.6.3
• 5.6.4

Website

• Product: https://github.com/filamentphp/filament/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion