GHSA-7M6H-RG42-M449

Vulnerability from github – Published: 2026-10-05 23:44 – Updated: 2026-10-05 23:44
VLAI
Summary
Filament: Multi-factor authentication (app) management actions do not require password reauthentication
Details

App-based multi-factor authentication management actions did not consistently require the user to confirm their current password. In particular, an authenticated session could set up app-based MFA and obtain recovery codes without password reauthentication. Disabling app-based MFA and regenerating recovery codes also accepted an existing app code or recovery code without requiring the current password. This issue does not affect email-based MFA.

If an attacker gains access to a user's authenticated session, they could enable app-based MFA and obtain recovery codes without knowing the user's password, changing the account's MFA configuration and potentially locking the legitimate user out. This issue does not by itself allow an unauthenticated attacker to sign in.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 4.13.2"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "filament/filament"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.13.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 5.8.2"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "filament/filament"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.8.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-104181"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-05T23:44:12Z",
    "nvd_published_at": "2026-10-01T21:17:18Z",
    "severity": "MODERATE"
  },
  "details": "App-based multi-factor authentication management actions did not consistently require the user to confirm their current password. In particular, an authenticated session could set up app-based MFA and obtain recovery codes without password reauthentication. Disabling app-based MFA and regenerating recovery codes also accepted an existing app code or recovery code without requiring the current password. This issue does not affect email-based MFA.\n\nIf an attacker gains access to a user\u0027s authenticated session, they could enable app-based MFA and obtain recovery codes without knowing the user\u0027s password, changing the account\u0027s MFA configuration and potentially locking the legitimate user out. This issue does not by itself allow an unauthenticated attacker to sign in.",
  "id": "GHSA-7m6h-rg42-m449",
  "modified": "2026-10-05T23:44:12Z",
  "published": "2026-10-05T23:44:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/filamentphp/filament/security/advisories/GHSA-7m6h-rg42-m449"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104181"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filamentphp/filament/pull/20522"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filamentphp/filament/commit/6d4dae6d7a94ce5aefd7ed4dc836acb0e6b71bb1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/filamentphp/filament"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filamentphp/filament/releases/tag/v4.13.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filamentphp/filament/releases/tag/v5.8.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Filament: Multi-factor authentication (app) management actions do not require password reauthentication"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.