CVE-2026-48166: Filament Timing Attack Vulnerability

CVE-2026-48166 Overview

CVE-2026-48166 is an observable timing discrepancy vulnerability in Filament, a collection of full-stack components for accelerated Laravel development. The login page measures different response times depending on whether a submitted email address corresponds to a registered account. Unauthenticated attackers can use this side channel to enumerate valid email addresses without supplying valid credentials.

The issue affects Filament versions from 4.0.0 up to 4.11.5 and the 5.x branch up to 5.6.5. The impact is limited to confirming whether an account exists for a given email address. Fixed releases are available in 4.11.5 and 5.6.5.

Critical Impact
Unauthenticated remote attackers can enumerate registered email addresses by measuring login response times, enabling targeted phishing and credential-stuffing campaigns.

Affected Products

Filament 4.0.0 through 4.11.4
Filament 5.0.0 through 5.6.4
Laravel applications using the Filament login component

Discovery Timeline

2026-06-22 - CVE-2026-48166 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-48166

Vulnerability Analysis

The vulnerability is classified under [CWE-208] Observable Timing Discrepancy. Filament's login workflow processes submitted credentials along different code paths depending on whether the supplied email maps to an existing user. When the email matches a known account, the application performs a password hash verification, which is intentionally expensive. When the email is not registered, the application short-circuits and returns a failure response without performing the hash comparison.

The measurable difference in response latency between these two paths allows an attacker to infer the existence of an account. An attacker scripting requests against the login endpoint can submit candidate email addresses and statistically classify each response as belonging to a registered or unregistered account based on elapsed time.

Root Cause

The root cause is asymmetric processing time between valid-user and invalid-user authentication branches. The authentication flow does not normalize execution time across both outcomes, so the cryptographic hash comparison for valid accounts produces a consistent timing signal. Constant-time authentication requires performing equivalent work regardless of account existence.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a sequence of POST requests to the Filament login endpoint with candidate email addresses and an arbitrary password. By comparing average response times across multiple samples per candidate, the attacker classifies each address as registered or not.

The enumerated email list can then feed targeted phishing, password spraying, or credential stuffing operations. Refer to the GitHub Security Advisory GHSA-5w46-g9pq-wh6f for vendor technical details.

Detection Methods for CVE-2026-48166

Indicators of Compromise

High volumes of failed login attempts originating from a small number of source IPs with varying email addresses but identical or empty passwords.
Sequential or dictionary-like email submissions to the Filament login endpoint within short time windows.
Repeated requests to /admin/login or custom Filament panel login routes from non-browser user agents.

Detection Strategies

Instrument the login endpoint to log per-request server-side processing time and flag statistical outliers in request volume per source.
Apply rate limiting and alerting on authentication endpoints when distinct usernames per source IP exceed a baseline threshold.
Correlate web access logs with WAF telemetry to identify enumeration patterns targeting filament panel routes.

Monitoring Recommendations

Track 4xx authentication response rates per source IP and per user-agent string over rolling windows.
Monitor for distributed enumeration where many low-volume sources collectively probe the same login endpoint.
Alert on requests submitting email addresses that do not exist in the user store at abnormal rates.

How to Mitigate CVE-2026-48166

Immediate Actions Required

Upgrade Filament to 4.11.5 if running the 4.x branch, or to 5.6.5 if running the 5.x branch.
Audit recent authentication logs for enumeration patterns and reset credentials for any accounts identified in suspected campaigns.
Apply rate limiting and CAPTCHA challenges on the login endpoint to slow automated probing.

Patch Information

The maintainers fixed the vulnerability in Filament 4.11.5 and 5.6.5. The patches normalize authentication processing time so that valid and invalid email submissions follow code paths with equivalent execution cost. Patch details are published in the GitHub Security Advisory GHSA-5w46-g9pq-wh6f.

Workarounds

Place the Filament admin panel behind an authenticated reverse proxy or VPN to remove unauthenticated network access to the login endpoint.
Enforce strict rate limits on login attempts per IP and per email address using Laravel's throttle middleware.
Deploy a Web Application Firewall rule that blocks high-frequency sequential email submissions to the login route.

bash

# Configuration example: enforce throttling on the Filament login route
# routes/web.php
Route::middleware(['throttle:5,1'])->group(function () {
    Route::post('/admin/login', [LoginController::class, 'authenticate']);
});