filamentphp filament prior 4.12.5/5.7.5 Multi-Factor Authentication Login.php canAccessPanel response discrepancy

Summaryinfo

A vulnerability, which was classified as problematic, was found in filamentphp filament. Affected by this vulnerability is the function canAccessPanel of the file packages/panels/src/Auth/Pages/Login.php of the component Multi-Factor Authentication. Such manipulation leads to response discrepancy. This vulnerability is documented as CVE-2026-84307. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in filamentphp filament. It has been rated as problematic. Affected by this issue is the function canAccessPanel of the file packages/panels/src/Auth/Pages/Login.php of the component Multi-Factor Authentication. The manipulation with an unknown input leads to a response discrepancy vulnerability. Using CWE to declare the problem leads to CWE-204. The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. Impacted is confidentiality. CVE summarizes:

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel(). For an account that canAccessPanel() denies, submitting the correct password renders the MFA challenge while an incorrect password returns the generic authentication failure, allowing an unauthenticated attacker to confirm whether a candidate password is valid for that account. When email-based MFA is configured, the correct-password path also sends a login code to the account holder. The issue applies only to accounts that have MFA enabled and are denied panel access. Authentication is not bypassed because canAccessPanel() still runs after the challenge, and no session is created. This issue is fixed in versions 4.12.5 and 5.7.5.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-84307 since 09/01/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

By approaching the search of inurl:packages/panels/src/Auth/Pages/Login.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 4.12.5 or 5.7.5 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• filamentphp

Name

• filament

Website

• Product: https://github.com/filamentphp/filament/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion