Read the docs
TI-2026-57942 Aliases CVE-2026-84307GHSA-xwpv-pqxp-5v36

Filament: Password validity disclosure for accounts denied panel access on login page

Priority LOW 18CWE-204Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-204.

Summary

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel(). For an account that canAccessPanel() denies, submitting the correct password renders the MFA challenge while an incorrect password returns the generic authentication failure, allowing an unauthenticated attacker to confirm whether a candidate password is valid for that account. When email-based MFA is configured, the correct-password path also sends a login code to the account holder. The issue applies only to accounts that have MFA enabled and are denied panel access. Authentication is not bypassed because canAccessPanel() still runs after the challenge, and no session is created. This issue is fixed in versions 4.12.5 and 5.7.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0046 40th percentileScored 2026-11-07
Fix Fixed filament (filamentphp): 4.12.5, 5.7.5filament/filament (Packagist): 4.12.5, 5.7.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
filamentphpfilament4.0.0 to before 4.12.5; 5.0.0 to before 5.7.54.12.5, 5.7.5Patch availableCNA
—filament/filament (Packagist)4.0.0 to before 4.12.54.12.5Patch availableGHSA-xwpv-pqxp-5v36
—filament/filament (Packagist)5.0.0 to before 5.7.55.7.5Patch availableGHSA-xwpv-pqxp-5v36
  • filament Vendorfilamentphp Affected 4.0.0 to before 4.12.5; 5.0.0 to before 5.7.5 Fixed in 4.12.5, 5.7.5 Patch available CNA
  • filament/filament (Packagist) Vendor— Affected 4.0.0 to before 4.12.5 Fixed in 4.12.5 Patch available GHSA-xwpv-pqxp-5v36
  • filament/filament (Packagist) Vendor— Affected 5.0.0 to before 5.7.5 Fixed in 5.7.5 Patch available GHSA-xwpv-pqxp-5v36

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:filamentphp:filament:*:*:*:*:*:*:*:*——filamentphp
  • cpe:2.3:a:filamentphp:filament:*:*:*:*:*:*:*:* Versions — — ·filamentphp

Remediation

  • Fix · CNA filament (filamentphp) Fixed in 4.12.5, 5.7.5
  • Fix · GHSA-xwpv-pqxp-5v36 filament/filament (Packagist) Fixed in 4.12.5 Advisory →
  • Fix · GHSA-xwpv-pqxp-5v36 filament/filament (Packagist) Fixed in 5.7.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-84307
  2. 2026-10-03 Alias added: GHSA-xwpv-pqxp-5v36

References

Other 6

  • TI-2024-34663 Exported files stored in default (`public`) filesystem if not reconfigured in filament CVSS 4.0LOW 2.3
  • TI-2026-54081 Filament: App-based MFA can be bypassed when recovery codes are enabled CVSS 3.1HIGH 8.1
  • TI-2025-41263 Filament's multi-factor authentication (app) recovery codes can be used multiple times CVSS 3.1HIGH 8.1
  • TI-2026-35861 Filament: Unauthenticated temporary file upload on auth pages CVSS 3.1MEDIUM 6.5
  • TI-2026-35865 Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission CVSS 3.1HIGH 7.4
  • TI-2026-39979 Filament: Disabled RichEditor field state can be used for XSS CVSS 3.1HIGH 7.6
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences