FilamentPHP Filament prior 4.12.6/5.7.6 Multi-Factor Authentication AppAuthentication.php verifyCode improper authentication

Summaryinfo

A vulnerability was found in FilamentPHP Filament. It has been rated as critical. Affected is the function AppAuthentication::verifyCode of the file packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php of the component Multi-Factor Authentication. Performing a manipulation results in improper authentication. This vulnerability was named CVE-2026-84306. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as critical, was found in FilamentPHP Filament. This affects the function AppAuthentication::verifyCode of the file packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php of the component Multi-Factor Authentication. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses AppAuthentication::verifyCode() with a used-code cache key derived from both the app authentication secret and the submitted TOTP code. This isolates the newest accepted timestep by code instead of by secret, allowing a previously issued app-based MFA code to be accepted after a newer code has already been used. Reuse of the exact same code was already prevented, but another code inside the accepted time window remained usable. An attacker who obtains the target account's password and one app-based MFA code can use that code for the remainder of the configured window, which is approximately four minutes with the default settings, even after the legitimate account holder logs in with a newer code. Email-based MFA is not affected. This issue is fixed in versions 4.12.6 and 5.7.6.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-84306 since 09/01/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit.

By approaching the search of inurl:packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 4.12.6 or 5.7.6 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• FilamentPHP

Name

• Filament

Website

• Product: https://github.com/filamentphp/filament/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion