CVE-2026-84307: Filament Laravel Auth Bypass Vulnerability

CVE-2026-84307 Overview

CVE-2026-84307 is a user enumeration and credential validation oracle in Filament, a full-stack component library for Laravel. The flaw resides in packages/panels/src/Auth/Pages/Login.php, which renders the multi-factor authentication (MFA) challenge before invoking canAccessPanel(). An unauthenticated attacker can distinguish valid from invalid passwords for accounts denied panel access, because a correct password advances to the MFA prompt while an incorrect password returns a generic failure. When email-based MFA is configured, the correct-password path also dispatches a login code to the account holder. The issue affects Filament versions from 4.0.0 up to 4.12.5 and 5.7.5, and is classified under CWE-204: Observable Response Discrepancy.

Critical Impact
Attackers can confirm valid credentials for MFA-enabled accounts denied panel access and trigger unsolicited MFA emails to targeted users.

Affected Products

Filament >= 4.0.0, < 4.12.5
Filament >= 5.0.0, < 5.7.5
Laravel applications using the Filament panels package with MFA enabled

Discovery Timeline

2026-09-01 - CVE-2026-84307 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84307

Vulnerability Analysis

The Filament login flow performs authentication in an incorrect sequence. When a user submits credentials, Login.php verifies the password, then presents the MFA challenge, and only afterwards evaluates canAccessPanel(). This ordering exposes an observable response discrepancy. Accounts that fail panel access checks still reach the MFA challenge stage when the password is correct, while wrong passwords return the generic authentication failure page.

An attacker can therefore submit candidate passwords against a known account and observe the response type. A rendered MFA challenge confirms the password is valid. A generic error indicates the password is invalid. No session is ever created, so authentication itself is not bypassed, but the oracle exposes credential validity.

The issue is scoped to accounts with MFA enabled and canAccessPanel() returning false. When email-based MFA is in use, the correct-password branch additionally emits a login code email, which can be abused for targeted user notification abuse or phishing pretext.

Root Cause

The root cause is control flow ordering in Login.php. Authorization checks that gate panel access run after the MFA challenge is presented. The fix moves isUserAllowedToAccessPanel() before the MFA branch and keeps the failure inside the existing Timebox, padding response duration so it matches the invalid-password path.

Attack Vector

Exploitation is network-reachable, requires no authentication, and no user interaction. The attacker needs only a valid target email or username and an MFA-enabled account that is denied panel access. Attack complexity is high because the account must satisfy both preconditions.

php

                $this->throwFailureValidationException();
            }

+           // This must run before the multi-factor challenge is presented, otherwise
+           // the challenge confirms that the password was valid for an account that
+           // can never sign in. It must also stay inside the `Timebox`, so that the
+           // failure is padded to the same duration as an invalid password.
+           if (! $this->isUserAllowedToAccessPanel($user)) {
+               $this->userUndertakingMultiFactorAuthentication = null;
+
+               $this->fireFailedEvent($authGuard, $user, $credentials);
+               $this->throwFailureValidationException();
+           }
+
            $timebox->returnEarly();

            return $user;

Source: Filament security patch commit ad5aacb

Detection Methods for CVE-2026-84307

Indicators of Compromise

Repeated POST requests to the Filament login endpoint for the same username with varying passwords from a single source IP or coordinated IP set.
Login attempts that terminate at the MFA challenge view but never complete authentication or create a session.
Bursts of email-based MFA login codes sent to accounts that lack panel access rights.
User reports of unsolicited MFA login code emails without corresponding legitimate sign-in activity.

Detection Strategies

Instrument the Filament login controller to log the outcome branch (invalid password, MFA presented, panel denied) with timestamps and source IP for correlation.
Alert on high-cardinality password guessing patterns targeting a single account, particularly when responses include the MFA challenge markup.
Correlate outbound MFA code emails with subsequent session creation, and flag emails that never result in a completed login.

Monitoring Recommendations

Monitor web server access logs for elevated request volume to /admin/login or configured Filament panel login routes.
Track authentication event streams for a rising ratio of MFA challenges issued to sessions established.
Review mail server logs for spikes in MFA code emails sent to individual mailboxes.

How to Mitigate CVE-2026-84307

Immediate Actions Required

Upgrade Filament to 4.12.5 or 5.7.5 immediately using Composer.
Audit user accounts that have MFA enabled and are denied panel access, and rotate credentials where suspicious login patterns exist.
Enable rate limiting on the Filament login route to blunt password guessing traffic.
Notify users who may have received unsolicited MFA login code emails.

Patch Information

The vulnerability is fixed in Filament v4.12.5 and Filament v5.7.5. The patch reorders the login flow to invoke isUserAllowedToAccessPanel() before the MFA challenge and keeps the denial inside the Timebox for timing parity. Full technical background is available in GitHub Security Advisory GHSA-xwpv-pqxp-5v36 and the pull request discussion.

Workarounds

Restrict access to Filament panel login routes with network-level allowlists or a web application firewall until upgrading.
Apply Laravel throttling middleware such as throttle:login to the panel login route to slow brute-force enumeration.
Disable email-based MFA temporarily to prevent unsolicited login code emissions if patching is delayed.

bash

# Upgrade Filament via Composer
composer require filament/filament:^5.7.5
# or for the 4.x branch
composer require filament/filament:^4.12.5

# Verify installed version
composer show filament/filament | grep versions