- Package
- filament/filament
- Fixed in
- 4.13.3, 5.8.3
- Published
- Tue 6 Oct 2026, 00:44 LisbonUpdated Mon 26 Oct 2026, 03:27 Lisbon
- Installs on Packagist
- 45M
In plain words
An attacker who gains access to a user's authenticated session could enable app-based MFA and obtain recovery codes without knowing the user's password, potentially locking the legitimate user out. Disabling app-based MFA or regenerating recovery codes also accepted an existing app code or recovery code without requiring the current password. Email-based MFA is not affected, and this flaw alone does not let an unauthenticated attacker sign in.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| filament/filament | >= 4.0.0, <= 4.13.2 | 4.13.3 |
| filament/filament | >= 5.0.0, <= 5.8.2 | 5.8.3 |
Am I affected?
Check composer.lock for filament/filament versions from 4.0.0 to 4.13.2 inclusive, or 5.0.0 to 5.8.2 inclusive. Then check whether your project makes app-based MFA management available, including setup, disabling and recovery-code management. Email-based MFA is not affected. The fixed versions are 4.13.3 and 5.8.3.
What to do
Check which version you have, then update to a fixed release for your branch (4.13.3, 5.8.3):
composer show filament/filament | grep versions
composer update filament/filamentIf your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.
The advisory's description
App-based multi-factor authentication management actions did not consistently require the user to confirm their current password. In particular, an authenticated session could set up app-based MFA and obtain recovery codes without password reauthentication. Disabling app-based MFA and regenerating recovery codes also accepted an existing app code or recovery code without requiring the current password. This issue does not affect email-based MFA.
If an attacker gains access to a user's authenticated session, they could enable app-based MFA and obtain recovery codes without knowing the user's password, changing the account's MFA configuration and potentially locking the legitimate user out. This issue does not by itself allow an unauthenticated attacker to sign in.
Weakness: CWE-306 Missing Authentication for Critical Function. Reported by Yezper, danharrin, ahbaqdadi.
The advisory
- GitHub Advisory Database: GHSA-7m6h-rg42-m449, with who is affected and how
- OSV.dev: GHSA-7m6h-rg42-m449
- The week's digest, with the other advisories from 5 Oct 2026
- All advisories for filament/filament