CVE-2026-84307
Received Received - Intake

Authentication Bypass via MFA Timing in Filament

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel(). For an account that canAccessPanel() denies, submitting the correct password renders the MFA challenge while an incorrect password returns the generic authentication failure, allowing an unauthenticated attacker to confirm whether a candidate password is valid for that account. When email-based MFA is configured, the correct-password path also sends a login code to the account holder. The issue applies only to accounts that have MFA enabled and are denied panel access. Authentication is not bypassed because canAccessPanel() still runs after the challenge, and no session is created. This issue is fixed in versions 4.12.5 and 5.7.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-02
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-84307
EUVD
EUVD-2026-69556

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
filamentphp filament to 4.12.3 (inc)
filamentphp filament to 5.7.3 (inc)
filamentphp filament 4.12.5
filamentphp filament 5.7.5
filament filament From 4.0.0 (inc) to 4.12.5 (inc)
filament filament 5.7.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-204 The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Filament PHP framework allows an attacker to check if a password is valid for a specific account by exploiting a timing discrepancy in the login process. When MFA is enabled and an account is denied panel access, submitting the correct password triggers an MFA challenge while an incorrect password shows a generic failure message. This reveals whether the password is valid without bypassing authentication.

Detection Guidance

To detect this vulnerability, check if your Filament PHP framework version is between 4.0.0-4.12.3 or 5.0.0-5.7.3. Run commands like 'composer show filament/filament' to verify the installed version. If using MFA, test login attempts with valid and invalid passwords for accounts denied panel access to observe inconsistent MFA challenge presentation.

Impact Analysis

An attacker could use this to confirm valid passwords for accounts with MFA enabled, potentially leading to unauthorized access if other credentials are compromised. It also risks exposing account existence by sending MFA codes to valid accounts, though authentication is not fully bypassed.

Compliance Impact

This vulnerability may violate compliance requirements by exposing user account information through password confirmation, potentially breaching data protection principles in GDPR or HIPAA. The information leakage could lead to unauthorized access attempts and unauthorized disclosure of user identities.

Mitigation Strategies

Immediately upgrade Filament to versions 4.12.5 or 5.7.5 or later. Update via Composer with 'composer require filament/filament:^4.12.5' or 'composer require filament/filament:^5.7.5'. Ensure panel access checks are enforced before MFA challenges in Login.php.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84307. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart