p PatchFirst

CVE-2026-77567

CVE-2026-77567 · Filament: App-based MFA can be bypassed when recovery codes are enabled

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected. This issue is fixed in versions 4.12.0 and 5.7.0.

CVSS 8.1 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • filament

    Versions
    • >= 4.0.0, < 4.12.0: Affected
    • >= 5.0.0, < 5.7.0: Affected

    No fix published

  • filament/filament Packagist

    Versions
    • v4.0.0
    • v4.0.1
    • v4.0.10
    • v4.0.11
    • v4.0.12
    • v4.0.13
    • v4.0.14
    • v4.0.15
    • v4.0.16
    • v4.0.17
    • v4.0.18
    • v4.0.19
    • v4.0.2
    • v4.0.20
    • v4.0.3
    • v4.0.4
    • v4.0.5
    • v4.0.6
    • v4.0.7
    • v4.0.8
    • v4.0.9
    • v4.1.0
    • v4.1.1
    • v4.1.10
    • v4.1.2
    • v4.1.3
    • v4.1.4
    • v4.1.5
    • v4.1.6
    • v4.1.7
    • v4.1.8
    • v4.1.9
    • v4.10.0
    • v4.10.1
    • v4.10.2
    • v4.11.0
    • v4.11.1
    • v4.11.2
    • v4.11.3
    • v4.11.4
    • v4.11.5
    • v4.11.6
    • v4.11.7
    • v4.11.8
    • v4.12.0-beta1
    • v4.12.0-beta2
    • v4.12.0-beta3
    • v4.12.0-beta4
    • v4.2.0
    • v4.2.1
    • v4.2.2
    • v4.2.3
    • v4.2.4
    • v4.3.0
    • v4.3.1
    • v4.4.0
    • v4.5.0
    • v4.5.1
    • v4.5.2
    • v4.5.3
    • v4.6.0
    • v4.6.1
    • v4.6.2
    • v4.6.3
    • v4.7.0
    • v4.7.1
    • v4.7.2
    • v4.7.3
    • v4.7.4
    • v4.8.0
    • v4.8.1
    • v4.8.2
    • v4.8.3
    • v4.8.4
    • v4.8.5
    • v4.9.0
    • v4.9.1
    • v4.9.2
    • v4.9.3
    • v4.9.4
    • v4.9.5
    Affected ranges
    • ECOSYSTEM: ≥ 4.0.0, < 4.12.0

    Update to 4.12.0

  • filament/filament Packagist

    Versions
    • v5.0.0
    • v5.1.0
    • v5.1.1
    • v5.1.2
    • v5.1.3
    • v5.2.0
    • v5.2.1
    • v5.2.2
    • v5.2.3
    • v5.2.4
    • v5.3.0
    • v5.3.1
    • v5.3.2
    • v5.3.3
    • v5.3.4
    • v5.3.5
    • v5.4.0
    • v5.4.1
    • v5.4.2
    • v5.4.3
    • v5.4.4
    • v5.4.5
    • v5.5.0
    • v5.5.1
    • v5.5.2
    • v5.6.0
    • v5.6.1
    • v5.6.2
    • v5.6.3
    • v5.6.4
    • v5.6.5
    • v5.6.6
    • v5.6.7
    • v5.6.8
    • v5.7.0-beta1
    • v5.7.0-beta2
    • v5.7.0-beta3
    • v5.7.0-beta4
    Affected ranges
    • ECOSYSTEM: ≥ 5.0.0, < 5.7.0

    Update to 5.7.0

Original sources

Check your server →