All vulnerabilities
CVE-2026-104181GHSA-7m6h-rg42-m449

filament/filament: Filament: Multi-factor authentication (app) management actions do not require password reauthentication

filamentphp filament/filamentcomposerLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.4Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 26% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.13.3Also 5.8.3GitHub
Published1 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 4.13.3filament/filament, composerGitHubcomposer require "filament/filament:^4.13.3"
  • 5.8.3filament/filament, composerGitHubcomposer require "filament/filament:^5.8.3"
  • 4.13.3filament/filament, PackagistOSVcomposer require "filament/filament:^4.13.3"
  • 5.8.3filament/filament, PackagistOSVcomposer require "filament/filament:^5.8.3"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

App-based multi-factor authentication management actions did not consistently require the user to confirm their current password. In particular, an authenticated session could set up app-based MFA and obtain recovery codes without password reauthentication. Disabling app-based MFA and regenerating recovery codes also accepted an existing app code or recovery code without requiring the current password. This issue does not affect email-based MFA.

If an attacker gains access to a user's authenticated session, they could enable app-based MFA and obtain recovery codes without knowing the user's password, changing the account's MFA configuration and potentially locking the legitimate user out. This issue does not by itself allow an unauthenticated attacker to sign in.

Text from GitHub Advisory Database

Affected versions 106

  • filament/filament, composer>= 4.0.0, <= 4.13.2GitHub
  • filament/filament, composer>= 5.0.0, <= 5.8.2GitHub
  • filamentaffected: >= 4.0.0, < 4.13.2CVE List
  • filamentaffected: >= 5.0.0, < 5.8.2CVE List
  • filament/filament, Packagistfrom 4.0.0, fixed in 4.13.3OSV
  • filament/filament, Packagistv4.0.0OSV
  • filament/filament, Packagistv4.0.1OSV
  • filament/filament, Packagistv4.0.10OSV
  • filament/filament, Packagistv4.0.11OSV
  • filament/filament, Packagistv4.0.12OSV
  • filament/filament, Packagistv4.0.13OSV
  • filament/filament, Packagistv4.0.14OSV
  • filament/filament, Packagistv4.0.15OSV
  • filament/filament, Packagistv4.0.16OSV
  • filament/filament, Packagistv4.0.17OSV
  • filament/filament, Packagistv4.0.18OSV
  • filament/filament, Packagistv4.0.19OSV
  • filament/filament, Packagistv4.0.2OSV
  • filament/filament, Packagistv4.0.20OSV
  • filament/filament, Packagistv4.0.3OSV
  • filament/filament, Packagistv4.0.4OSV
  • filament/filament, Packagistv4.0.5OSV
  • filament/filament, Packagistv4.0.6OSV
  • filament/filament, Packagistv4.0.7OSV
  • filament/filament, Packagistv4.0.8OSV
  • filament/filament, Packagistv4.0.9OSV
  • filament/filament, Packagistv4.1.0OSV
  • filament/filament, Packagistv4.1.1OSV
  • filament/filament, Packagistv4.1.10OSV
  • filament/filament, Packagistv4.1.2OSV
  • filament/filament, Packagistv4.1.3OSV
  • filament/filament, Packagistv4.1.4OSV
  • filament/filament, Packagistv4.1.5OSV
  • filament/filament, Packagistv4.1.6OSV
  • filament/filament, Packagistv4.1.7OSV
  • filament/filament, Packagistv4.1.8OSV
  • filament/filament, Packagistv4.1.9OSV
  • filament/filament, Packagistv4.10.0OSV
  • filament/filament, Packagistv4.10.1OSV
  • filament/filament, Packagistv4.10.2OSV
  • filament/filament, Packagistv4.11.0OSV
  • filament/filament, Packagistv4.11.1OSV
  • filament/filament, Packagistv4.11.2OSV
  • filament/filament, Packagistv4.11.3OSV
  • filament/filament, Packagistv4.11.4OSV
  • filament/filament, Packagistv4.11.5OSV
  • filament/filament, Packagistv4.11.6OSV
  • filament/filament, Packagistv4.11.7OSV
  • filament/filament, Packagistv4.11.8OSV
  • filament/filament, Packagistv4.12.0OSV
  • filament/filament, Packagistv4.12.0-beta1OSV
  • filament/filament, Packagistv4.12.0-beta2OSV
  • filament/filament, Packagistv4.12.0-beta3OSV
  • filament/filament, Packagistv4.12.0-beta4OSV
  • filament/filament, Packagistv4.12.1OSV
  • filament/filament, Packagistfrom 5.0.0, fixed in 5.8.3OSV
  • filament/filament, Packagistv5.0.0OSV
  • filament/filament, Packagistv5.1.0OSV
  • filament/filament, Packagistv5.1.1OSV
  • filament/filament, Packagistv5.1.2OSV
  • filament/filament, Packagistv5.1.3OSV
  • filament/filament, Packagistv5.2.0OSV
  • filament/filament, Packagistv5.2.1OSV
  • filament/filament, Packagistv5.2.2OSV
  • filament/filament, Packagistv5.2.3OSV
  • filament/filament, Packagistv5.2.4OSV
  • filament/filament, Packagistv5.3.0OSV
  • filament/filament, Packagistv5.3.1OSV
  • filament/filament, Packagistv5.3.2OSV
  • filament/filament, Packagistv5.3.3OSV
  • filament/filament, Packagistv5.3.4OSV
  • filament/filament, Packagistv5.3.5OSV
  • filament/filament, Packagistv5.4.0OSV
  • filament/filament, Packagistv5.4.1OSV
  • filament/filament, Packagistv5.4.2OSV
  • filament/filament, Packagistv5.4.3OSV
  • filament/filament, Packagistv5.4.4OSV
  • filament/filament, Packagistv5.4.5OSV
  • filament/filament, Packagistv5.5.0OSV
  • filament/filament, Packagistv5.5.1OSV
  • filament/filament, Packagistv5.5.2OSV
  • filament/filament, Packagistv5.6.0OSV
  • filament/filament, Packagistv5.6.1OSV
  • filament/filament, Packagistv5.6.2OSV
  • filament/filament, Packagistv5.6.3OSV
  • filament/filament, Packagistv5.6.4OSV
  • filament/filament, Packagistv5.6.5OSV
  • filament/filament, Packagistv5.6.6OSV
  • filament/filament, Packagistv5.6.7OSV
  • filament/filament, Packagistv5.6.8OSV
  • filament/filament, Packagistv5.7.0OSV
  • filament/filament, Packagistv5.7.0-beta1OSV
  • filament/filament, Packagistv5.7.0-beta2OSV
  • filament/filament, Packagistv5.7.0-beta3OSV
  • filament/filament, Packagistv5.7.0-beta4OSV
  • filament/filament, Packagistv5.7.1OSV
  • filament/filament, Packagistv5.7.2OSV
  • filament/filament, Packagistv5.7.3OSV
  • filament/filament, Packagistv5.7.4OSV
  • filament/filament, Packagistv5.7.5OSV
  • filament/filament, Packagistv5.7.6OSV
  • filament/filament, Packagistv5.7.7OSV
  • filament/filament, Packagistv5.7.8OSV
  • filament/filament, Packagistv5.8.0OSV
  • filament/filament, Packagistv5.8.1OSV
  • filament/filament, Packagistv5.8.2OSV

References 7