CVE-2026-77567: Filament Laravel Auth Bypass Vulnerability

CVE-2026-77567 Overview

CVE-2026-77567 is an authentication bypass vulnerability in Filament, a collection of full-stack components for accelerated Laravel development. The flaw affects app-based multi-factor authentication (MFA) when recovery codes are enabled. Incorrect challenge-form required-field handling permits attackers with valid primary credentials to bypass the second authentication factor. Email-based MFA is not affected. The issue is fixed in Filament versions 4.12.0 and 5.7.0. This weakness is classified under [CWE-287: Improper Authentication].

Critical Impact
An attacker with knowledge of a user's password can bypass app-based MFA on Filament panels where recovery codes are enabled, gaining full authenticated access to protected administrative interfaces.

Affected Products

Filament versions prior to 4.12.0 (4.x branch)
Filament versions prior to 5.7.0 (5.x branch)
Laravel applications using Filament panels with app-based multi-factor authentication and recovery codes enabled

Discovery Timeline

2026-08-24 - CVE-2026-77567 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-77567

Vulnerability Analysis

The vulnerability resides in Filament's multi-factor authentication challenge form. When recovery codes are enabled for a user, the challenge form conditionally requires either a time-based one-time password (TOTP) code or a recovery code. The required validation rule on the primary code field is disabled whenever the useRecoveryCode flag is set, without also verifying that a recovery code was actually supplied.

An attacker who has already obtained a user's password can submit the MFA challenge with useRecoveryCode toggled and both code fields left blank. The server-side validation accepts the empty submission and completes authentication, granting access without any second factor. The flaw affects both the login challenge in AppAuthentication.php and the DisableAppAuthenticationAction.php action used to disable app authentication from user settings.

Root Cause

The root cause is a logic error in the conditional required closure applied to the code input. The original closure returned false whenever recovery mode was selected, treating the field as optional without cross-checking that the alternative recoveryCode input was populated. This allowed the entire challenge form to pass validation with no credential material submitted for the second factor.

Attack Vector

Exploitation requires network access to the Filament panel and valid first-factor credentials for a target account with app-based MFA and recovery codes enabled. The attacker submits the MFA challenge form with the recovery-code flag enabled and both code fields empty. No user interaction is required beyond the attacker's own submission.

php

// Vulnerable vs patched validation rule
// File: packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php

->action(fn (Set $set) => $set('useRecoveryCode', true))
->visible(fn (): bool => $isRecoverable && (! $get('useRecoveryCode'))))
->validationAttribute(__('filament-panels::auth/multi-factor/app/provider.login_form.code.validation_attribute'))
-                ->required(fn (Get $get): bool => (! $isRecoverable) || (! $get('useRecoveryCode')))
+                ->required(fn (Get $get): bool => (! $isRecoverable) || (! $get('useRecoveryCode')) || blank($get('recoveryCode')))
->rule(function () use ($user): Closure {
    return function (string $attribute, #[SensitiveParameter] $value, Closure $fail) use ($user): void {
        if ($this->verifyCode($value, $this->getSecret($user), shouldPreventCodeReuse: true)) {

Source: Filament security patch commit 45534a6. The patch adds a blank($get('recoveryCode')) check so that the code field is still required when no recovery code has been submitted.

Detection Methods for CVE-2026-77567

Indicators of Compromise

Successful authentications to Filament panels with no corresponding TOTP verification event in application logs
Login events immediately followed by administrative actions from unfamiliar IP addresses or user agents
Increased rate-limit hits against the filament-disable-app-authentication throttling key
MFA challenge submissions with empty code and recoveryCode fields observed in web server request logs

Detection Strategies

Audit Filament authentication logs for successful sessions on accounts where MFA is enabled but no second-factor verification was recorded.
Inspect HTTP POST bodies to the MFA challenge endpoint for requests with useRecoveryCode=true and blank code parameters.
Correlate authentication success with subsequent privileged operations to identify sessions established without a valid second factor.

Monitoring Recommendations

Enable verbose audit logging for the Filament\Auth\MultiFactor namespace and forward events to a central log store.
Alert on any authentication event where the user has recovery codes enabled but no recoveryCode value or code value was validated.
Track version strings of Filament in deployment manifests and flag installations still on releases prior to 4.12.0 or 5.7.0.

How to Mitigate CVE-2026-77567

Immediate Actions Required

Upgrade Filament to version 4.12.0 or 5.7.0 (or later) using Composer as soon as possible.
Rotate recovery codes for all users who had app-based MFA enabled prior to patching.
Review recent Filament panel authentication logs for evidence of exploitation and revoke suspicious sessions.
Force password resets for privileged accounts if unexplained administrative activity is observed.

Patch Information

The fix is applied in commit 45534a6f87f50ac6df3b43680bb33f8da9ef207b and released in Filament v4.12.0 and Filament v5.7.0. Full details are in GitHub Security Advisory GHSA-52xp-w8hr-xv3c. The patch adds a blank($get('recoveryCode')) condition to the required rule on the code field so the challenge cannot be submitted with both fields empty.

Workarounds

Disable recovery codes for app-based MFA until the upgrade is applied; the bypass depends on recovery codes being enabled.
Switch affected accounts to email-based MFA, which is not affected by this vulnerability.
Restrict access to Filament panels behind network controls such as VPN or IP allow-listing while patching is in progress.

bash

# Upgrade Filament via Composer
composer require filament/filament:^5.7.0
# or for the 4.x branch
composer require filament/filament:^4.12.0

# Verify installed version
php artisan about | grep -i filament
composer show filament/filament | grep versions