CVE-2026-84306
Received Received - Intake

Authentication Bypass via TOTP Code Reuse in Filament

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses AppAuthentication::verifyCode() with a used-code cache key derived from both the app authentication secret and the submitted TOTP code. This isolates the newest accepted timestep by code instead of by secret, allowing a previously issued app-based MFA code to be accepted after a newer code has already been used. Reuse of the exact same code was already prevented, but another code inside the accepted time window remained usable. An attacker who obtains the target account's password and one app-based MFA code can use that code for the remainder of the configured window, which is approximately four minutes with the default settings, even after the legitimate account holder logs in with a newer code. Email-based MFA is not affected. This issue is fixed in versions 4.12.6 and 5.7.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-02
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-84306
EUVD
EUVD-2026-69555

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
filament filament From 4.0.0 (inc) to 4.12.6 (inc)
filament filament 5.7.6
filamentphp filament From 4.0.0 (inc) to 4.12.4 (inc)
filamentphp filament From 5.0.0 (inc) to 5.7.4 (inc)
filamentphp filament 4.12.6
filamentphp filament 5.7.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-294 A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Filament, a Laravel development framework. It involves a flaw in multi-factor authentication (MFA) where app-based codes can be reused within a time window. Specifically, the system caches used codes in a way that allows an attacker with a valid password and one MFA code to continue using that code for the entire default 4-minute window, even after the legitimate user generates a new code.

Detection Guidance

To detect this vulnerability, check if your Filament PHP framework version is between 4.0.0 and 4.12.4 or between 5.0.0 and 5.7.4. Run commands like 'composer show filament/filament' to verify installed versions. If affected, inspect MFA logs for repeated code usage within the time window.

Impact Analysis

If you use Filament with app-based MFA, an attacker who steals your password and one MFA code could bypass additional security measures for up to 4 minutes. This could allow unauthorized access to your account during that window, even if you log in with a new code.

Compliance Impact

This vulnerability could undermine compliance with data protection regulations like GDPR or HIPAA by allowing unauthorized access to sensitive data. If an attacker gains access to protected information due to this flaw, it may violate regulatory requirements for access controls and data security.

Mitigation Strategies
  • Upgrade Filament to versions 4.12.6 or 5.7.6 or later to patch the vulnerability.
  • Review and rotate all MFA secrets and codes for affected users.
  • Monitor authentication logs for suspicious repeated code usage attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84306. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart