CVE-2025-67507
CVE-2025-67507 · Filament's multi-factor authentication (app) recovery codes can be used multiple times
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.3.0 contain a flaw in the handling of recovery codes for app-based multi-factor authentication, allowing the same recovery code to be reused indefinitely. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. This issue is fixed in version 4.3.1.
CVSS 8.1 · Alta · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
filament
- Versiones
- >= 4.0.0, < 4.3.1: Afectada
Sin corrección publicada
filament/filament Packagist
- Versiones
- v4.0.0
- v4.0.1
- v4.0.10
- v4.0.11
- v4.0.12
- v4.0.13
- v4.0.14
- v4.0.15
- v4.0.16
- v4.0.17
- v4.0.18
- v4.0.19
- v4.0.2
- v4.0.20
- v4.0.3
- v4.0.4
- v4.0.5
- v4.0.6
- v4.0.7
- v4.0.8
- v4.0.9
- v4.1.0
- v4.1.1
- v4.1.10
- v4.1.2
- v4.1.3
- v4.1.4
- v4.1.5
- v4.1.6
- v4.1.7
- v4.1.8
- v4.1.9
- v4.2.0
- v4.2.1
- v4.2.2
- v4.2.3
- v4.2.4
- v4.3.0
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 4.0.0, < 4.3.1
Actualiza a 4.3.1