Filament: Multi-factor authentication (app) management actions do not require password reauthentication
Medium · CVSS 5.4
App-based multi-factor authentication management actions did not consistently require the user to confirm their current password. In particular, an authenticated session could set up app-based MFA and obtain recovery codes without password reauthentication. Disabling app-based MFA and regenerating recovery codes also accepted an existing app code or recovery code without requiring the current password. This issue does not affect email-based MFA.
Remediation
Upgrade filament/filament to 4.13.3 or later. Upgrade filament/filament to 5.8.3 or later.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-7m6h-rg42-m449