p PatchFirst

CVE-2026-104181

CVE-2026-104181 · Filament: Multi-factor authentication (app) management actions do not require password reauthentication

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication management actions do not consistently require confirmation of the current password. An attacker with access to an authenticated user session can set up app-based MFA and obtain recovery codes, or disable app-based MFA and regenerate recovery codes by supplying an existing app code or recovery code, without knowing the account password. Email-based MFA is not affected, and the issue does not independently permit an unauthenticated sign-in, but changing the app-MFA configuration may lock the legitimate user out. This issue is fixed in versions 4.13.3 and 5.8.3.

CVSS 5.4 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • filament

    Versions
    • >= 4.0.0, < 4.13.2: Affected
    • >= 5.0.0, < 5.8.2: Affected

    No fix published

  • filament/filament Packagist

    Versions
    • v4.0.0
    • v4.0.1
    • v4.0.10
    • v4.0.11
    • v4.0.12
    • v4.0.13
    • v4.0.14
    • v4.0.15
    • v4.0.16
    • v4.0.17
    • v4.0.18
    • v4.0.19
    • v4.0.2
    • v4.0.20
    • v4.0.3
    • v4.0.4
    • v4.0.5
    • v4.0.6
    • v4.0.7
    • v4.0.8
    • v4.0.9
    • v4.1.0
    • v4.1.1
    • v4.1.10
    • v4.1.2
    • v4.1.3
    • v4.1.4
    • v4.1.5
    • v4.1.6
    • v4.1.7
    • v4.1.8
    • v4.1.9
    • v4.10.0
    • v4.10.1
    • v4.10.2
    • v4.11.0
    • v4.11.1
    • v4.11.2
    • v4.11.3
    • v4.11.4
    • v4.11.5
    • v4.11.6
    • v4.11.7
    • v4.11.8
    • v4.12.0
    • v4.12.0-beta1
    • v4.12.0-beta2
    • v4.12.0-beta3
    • v4.12.0-beta4
    • v4.12.1
    • v4.12.2
    • v4.12.3
    • v4.12.4
    • v4.12.5
    • v4.12.6
    • v4.12.7
    • v4.12.8
    • v4.13.0
    • v4.13.1
    • v4.13.2
    • v4.2.0
    • v4.2.1
    • v4.2.2
    • v4.2.3
    • v4.2.4
    • v4.3.0
    • v4.3.1
    • v4.4.0
    • v4.5.0
    • v4.5.1
    • v4.5.2
    • v4.5.3
    • v4.6.0
    • v4.6.1
    • v4.6.2
    • v4.6.3
    • v4.7.0
    • v4.7.1
    • v4.7.2
    • v4.7.3
    • v4.7.4
    • v4.8.0
    • v4.8.1
    • v4.8.2
    • v4.8.3
    • v4.8.4
    • v4.8.5
    • v4.9.0
    • v4.9.1
    • v4.9.2
    • v4.9.3
    • v4.9.4
    • v4.9.5
    Affected ranges
    • ECOSYSTEM: ≥ 4.0.0, < 4.13.3

    Update to 4.13.3

  • filament/filament Packagist

    Versions
    • v5.0.0
    • v5.1.0
    • v5.1.1
    • v5.1.2
    • v5.1.3
    • v5.2.0
    • v5.2.1
    • v5.2.2
    • v5.2.3
    • v5.2.4
    • v5.3.0
    • v5.3.1
    • v5.3.2
    • v5.3.3
    • v5.3.4
    • v5.3.5
    • v5.4.0
    • v5.4.1
    • v5.4.2
    • v5.4.3
    • v5.4.4
    • v5.4.5
    • v5.5.0
    • v5.5.1
    • v5.5.2
    • v5.6.0
    • v5.6.1
    • v5.6.2
    • v5.6.3
    • v5.6.4
    • v5.6.5
    • v5.6.6
    • v5.6.7
    • v5.6.8
    • v5.7.0
    • v5.7.0-beta1
    • v5.7.0-beta2
    • v5.7.0-beta3
    • v5.7.0-beta4
    • v5.7.1
    • v5.7.2
    • v5.7.3
    • v5.7.4
    • v5.7.5
    • v5.7.6
    • v5.7.7
    • v5.7.8
    • v5.8.0
    • v5.8.1
    • v5.8.2
    Affected ranges
    • ECOSYSTEM: ≥ 5.0.0, < 5.8.3

    Update to 5.8.3

Original sources

Check your server →