cyfenced.com →

[ CVE-2026-104181 · Published 1 Oct 2026 ]

Filament: Multi-factor authentication (app) management actions do not require password reauthentication

CVSS 5.4 EPSS <1%Fix available

[ Description ]Official description

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication management actions do not consistently require confirmation of the current password. An attacker with access to an authenticated user session can set up app-based MFA and obtain recovery codes, or disable app-based MFA and regenerate recovery codes by supplying an existing app code or recovery code, without knowing the account password. Email-based MFA is not affected, and the issue does not independently permit an unauthenticated sign-in, but changing the app-MFA configuration may lock the legitimate user out. This issue is fixed in versions 4.13.3 and 5.8.3.

[ Fixes ]Fixes and patches

  • filament/filament 4.13.3Fixed version · GitHub Advisories · composer package filament/filament: upgrade to 4.13.3 or later (affected >= 4.0.0, <= 4.13.2)
  • filament/filament 5.8.3Fixed version · GitHub Advisories · composer package filament/filament: upgrade to 5.8.3 or later (affected >= 5.0.0, <= 5.8.2)

[ Packages ]Affected open-source packages

  • filament/filament composerAffected >= 4.0.0, <= 4.13.2 · fixed in 4.13.3 · GHSA-7m6h-rg42-m449
  • filament/filament composerAffected >= 5.0.0, <= 5.8.2 · fixed in 5.8.3 · GHSA-7m6h-rg42-m449

[ References ]References