Vulnerability-Lookup

GHSA-R3J6-GPJW-QFJR

Vulnerability from github – Published: 2026-09-01 21:29 – Updated: 2026-09-01 21:29

Summary

Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used

Details

A flaw in the handling of one-time codes for app-based multi-factor authentication allows a previously issued code to be used after a newer code has already been accepted. This issue does not affect email-based MFA. Submitting the exact same code twice was already prevented, but any other code within the accepted time window was not.

If an attacker gains access to both the user's password and a single one-time code, that code stays usable for the remainder of its time window, which is around four minutes on the default settings, including after the legitimate user has already logged in with a newer code.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "filament/filament"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.12.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "filament/filament"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.7.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-84306"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-294"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-01T21:29:43Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "A flaw in the handling of one-time codes for app-based multi-factor authentication allows a previously issued code to be used after a newer code has already been accepted. This issue does not affect email-based MFA. Submitting the exact same code twice was already prevented, but any other code within the accepted time window was not.\n\nIf an attacker gains access to both the user\u0027s password and a single one-time code, that code stays usable for the remainder of its time window, which is around four minutes on the default settings, including after the legitimate user has already logged in with a newer code.",
  "id": "GHSA-r3j6-gpjw-qfjr",
  "modified": "2026-09-01T21:29:43Z",
  "published": "2026-09-01T21:29:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/filamentphp/filament/security/advisories/GHSA-r3j6-gpjw-qfjr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filamentphp/filament/pull/20335"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filamentphp/filament/commit/b6bde8572bcac75d4f5b4ec892ba7b9e91e0ab4d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/filamentphp/filament"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filamentphp/filament/releases/tag/v4.12.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filamentphp/filament/releases/tag/v5.7.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used"
}

CVE-2026-84306 (GCVE-0-2026-84306)

Vulnerability from cvelistv5 – Published: 2026-09-01 19:10 – Updated: 2026-09-04 02:06

Title

Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used

Summary

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses AppAuthentication::verifyCode() with a used-code cache key derived from both the app authentication secret and the submitted TOTP code. This isolates the newest accepted timestep by code instead of by secret, allowing a previously issued app-based MFA code to be accepted after a newer code has already been used. Reuse of the exact same code was already prevented, but another code inside the accepted time window remained usable. An attacker who obtains the target account's password and one app-based MFA code can use that code for the remainder of the configured window, which is approximately four minutes with the default settings, even after the legitimate account holder logs in with a newer code. Email-based MFA is not affected. This issue is fixed in versions 4.12.6 and 5.7.6.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-04 02:06 UTC

CWE

CWE-294 - Authentication Bypass by Capture-replay

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/filamentphp/filament/security/…	x_refsource_CONFIRM
https://github.com/filamentphp/filament/pull/20335	x_refsource_MISC
https://github.com/filamentphp/filament/commit/b6…	x_refsource_MISC
https://github.com/filamentphp/filament/releases/…	x_refsource_MISC
https://github.com/filamentphp/filament/releases/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
filamentphp	filament	Affected: >= 4.0.0, < 4.12.6 Affected: >= 5.0.0, < 5.7.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84306",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-04T02:06:10.316293Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-04T02:06:19.110Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "filament",
          "vendor": "filamentphp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.12.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.7.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses AppAuthentication::verifyCode() with a used-code cache key derived from both the app authentication secret and the submitted TOTP code. This isolates the newest accepted timestep by code instead of by secret, allowing a previously issued app-based MFA code to be accepted after a newer code has already been used. Reuse of the exact same code was already prevented, but another code inside the accepted time window remained usable. An attacker who obtains the target account\u0027s password and one app-based MFA code can use that code for the remainder of the configured window, which is approximately four minutes with the default settings, even after the legitimate account holder logs in with a newer code. Email-based MFA is not affected. This issue is fixed in versions 4.12.6 and 5.7.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-294",
              "description": "CWE-294: Authentication Bypass by Capture-replay",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T19:10:47.969Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/filamentphp/filament/security/advisories/GHSA-r3j6-gpjw-qfjr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/filamentphp/filament/security/advisories/GHSA-r3j6-gpjw-qfjr"
        },
        {
          "name": "https://github.com/filamentphp/filament/pull/20335",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/filamentphp/filament/pull/20335"
        },
        {
          "name": "https://github.com/filamentphp/filament/commit/b6bde8572bcac75d4f5b4ec892ba7b9e91e0ab4d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/filamentphp/filament/commit/b6bde8572bcac75d4f5b4ec892ba7b9e91e0ab4d"
        },
        {
          "name": "https://github.com/filamentphp/filament/releases/tag/v4.12.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/filamentphp/filament/releases/tag/v4.12.6"
        },
        {
          "name": "https://github.com/filamentphp/filament/releases/tag/v5.7.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/filamentphp/filament/releases/tag/v5.7.6"
        }
      ],
      "source": {
        "advisory": "GHSA-r3j6-gpjw-qfjr",
        "discovery": "UNKNOWN"
      },
      "title": "Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-84306",
    "datePublished": "2026-09-01T19:10:47.969Z",
    "dateReserved": "2026-09-01T16:17:43.078Z",
    "dateUpdated": "2026-09-04T02:06:19.110Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-R3J6-GPJW-QFJR

CVE-2026-84306 (GCVE-0-2026-84306)

Tags

Sightings

Nomenclature