Summary
Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used
Advisory details
A flaw in the handling of one-time codes for app-based multi-factor authentication allows a previously issued code to be used after a newer code has already been accepted. This issue does not affect email-based MFA. Submitting the exact same code twice was already prevented, but any other code within the accepted time window was not.
If an attacker gains access to both the user's password and a single one-time code, that code stays usable for the remainder of its time window, which is around four minutes on the default settings, including after the legitimate user has already logged in with a newer code.
References
- https://github.com/advisories/GHSA-r3j6-gpjw-qfjr
- https://github.com/filamentphp/filament/security/advisories/GHSA-r3j6-gpjw-qfjr
- https://github.com/filamentphp/filament/pull/20335
- https://github.com/filamentphp/filament/commit/b6bde8572bcac75d4f5b4ec892ba7b9e91e0ab4d
- https://github.com/filamentphp/filament/releases/tag/v4.12.6
- https://github.com/filamentphp/filament/releases/tag/v5.7.6
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-69206
Http4s: DigestAuth allows replay of captured requests
- HIGHCVE-2026-96627
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
- MEDIUMCVE-2026-96628
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
- CRITICALCVE-2026-105192
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
- HIGHCVE-2026-100349
kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content
- MEDIUMCVE-2026-58494
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination