CVE-2026-84306: Filament Laravel Auth Bypass Vulnerability

CVE-2026-84306 Overview

Filament is a collection of full-stack components for accelerated Laravel development. CVE-2026-84306 is an improper authentication vulnerability [CWE-294] in the app-based multi-factor authentication (MFA) flow of Filament panels. The flaw resides in packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php, where AppAuthentication::verifyCode() derives the used-code cache key from both the app authentication secret and the submitted TOTP code. This scoping lets a previously issued but still-in-window TOTP remain valid after a newer code has already been consumed. Versions 4.0.0 through 4.12.5 and 5.0.0 through 5.7.5 are affected. Email-based MFA is not affected.

Critical Impact
An attacker who has the target account's password and any single app-based MFA code can authenticate for the remainder of the accepted time window — approximately four minutes with default settings — even after the legitimate user has logged in with a newer code.

Affected Products

Filament (Laravel) versions 4.0.0 through 4.12.5
Filament (Laravel) versions 5.0.0 through 5.7.5
packages/panels component using app-based (TOTP) MFA

Discovery Timeline

2026-09-01 - CVE-2026-84306 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-84306

Vulnerability Analysis

The vulnerability is an authentication weakness in Filament's app-based MFA verification. Filament caches used TOTP codes to prevent replay of the exact same value. However, the cache key combines the account secret with the submitted code, isolating replay tracking per-code rather than per-secret. As a result, marking one code as used does not invalidate any other code accepted within the same TOTP time window.

TOTP implementations typically accept a small window of adjacent timesteps to tolerate clock drift. Filament's default window is roughly four minutes wide. During that window, multiple distinct codes are cryptographically valid. Because the used-code cache is scoped by (secret, code), an attacker holding one intercepted code retains the ability to submit it repeatedly across the window even after the legitimate user has authenticated with a later code.

Root Cause

The root cause is the composition of the used-code cache key. By including both the secret and the code, the implementation only prevents reuse of the identical code value. Correct behavior tracks the newest accepted timestep per secret and rejects any earlier or equal timestep. The fix changes the cache key to a hash of the secret alone and introduces a shouldPreventCodeReuse parameter on verifyCode().

Attack Vector

An attacker must first obtain the victim's password and one valid app-based MFA code, for example through phishing, an adversary-in-the-middle proxy, or shoulder-surfing. With those two elements, the attacker can log in to the Filament panel and continue to authenticate using the same intercepted code until it falls outside the acceptance window, even if the legitimate user has completed their own login using a subsequent code.

php

// Security patch (Source: https://github.com/filamentphp/filament/commit/b6bde8572bcac75d4f5b4ec892ba7b9e91e0ab4d)
// packages/panels/src/Auth/MultiFactor/App/Actions/DisableAppAuthenticationAction.php

                             RateLimiter::hit($rateLimitingKey);

-                            if (is_string($value) && $appAuthentication->verifyCode($value)) {
+                            if (is_string($value) && $appAuthentication->verifyCode($value, shouldPreventCodeReuse: true)) {
                                 return;
                             }

// packages/panels/src/Auth/MultiFactor/App/Actions/RegenerateAppAuthenticationRecoveryCodesAction.php

                             RateLimiter::hit($rateLimitingKey);

-                            if ($appAuthentication->verifyCode($value)) {
+                            if ($appAuthentication->verifyCode($value, shouldPreventCodeReuse: true)) {
                                 return;
                             }

The patch invokes verifyCode() with shouldPreventCodeReuse: true and changes the cache key derivation to hash only the secret, ensuring the newest accepted timestep invalidates all earlier codes in the window.

Detection Methods for CVE-2026-84306

Indicators of Compromise

Two successful MFA-completed authentications for the same account from different source IP addresses or user agents within a ~4 minute window.
Repeated successful logins that consume TOTP codes with monotonically decreasing timesteps for the same account.
Anomalous session creation on a Filament panel immediately following a legitimate user's login from a different network location.

Detection Strategies

Correlate Filament panel authentication logs with source geolocation and device fingerprint to identify parallel successful logins for the same identity.
Instrument application logs to record the TOTP timestep (not the code) accepted for each login and alert on out-of-order timestep acceptance.
Review reverse-proxy and web server logs for burst POST requests to Filament MFA verification endpoints from unfamiliar IPs.

Monitoring Recommendations

Enable session-level auditing on Filament panels and forward events to a centralized log pipeline for retention and correlation.
Alert on MFA verification success followed by a session from a different IP or ASN within the TOTP validity window.
Track Filament package versions across deployments and flag any instance still running 4.0.0–4.12.5 or 5.0.0–5.7.5.

How to Mitigate CVE-2026-84306

Immediate Actions Required

Upgrade Filament to version 4.12.6 or 5.7.6 using composer update filament/filament.
Invalidate active panel sessions after upgrading to force re-authentication under the fixed logic.
Rotate credentials for accounts showing anomalous authentication patterns and require users to re-enroll TOTP secrets if compromise is suspected.

Patch Information

The issue is fixed in Filament Release v4.12.6 and Filament Release v5.7.6. See the GitHub Security Advisory GHSA-r3j6-gpjw-qfjr, GitHub Pull Request #20335, and the remediation commit for implementation details.

Workarounds

Switch affected panels to email-based MFA, which is not impacted by this issue, until an upgrade can be scheduled.
Reduce the accepted TOTP window in configuration to shrink the reuse period if a temporary mitigation is required.
Enforce strict source-IP or device-binding policies on Filament panel sessions to limit the utility of a captured MFA code.

bash

# Upgrade Filament to a patched release
composer require filament/filament:^4.12.6
# or, for the 5.x branch
composer require filament/filament:^5.7.6

# Verify installed version
composer show filament/filament | grep versions