{"id":"CVE-2026-48166","title":"Filament: Timing-based user enumeration on login page","summary":"Filament: Timing-based user enumeration on login page","severity":"medium","cvss":5.3,"cwe":["CWE-208"],"vendor":"filament","product":"filament/filament","ecosystem":"composer","affected":["filament/filament >= 4.0.0, <= 4.11.4","filament/filament >= 5.0.0, <= 5.6.4"],"patched":["filament/filament 4.11.5","filament/filament 5.6.5"],"published":"2026-06-23","updated":"2026-06-23","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-5w46-g9pq-wh6f","references":[{"url":"https://github.com/filamentphp/filament/security/advisories/GHSA-5w46-g9pq-wh6f"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48166"},{"url":"https://github.com/advisories/GHSA-5w46-g9pq-wh6f"}],"tags":["ghsa","composer"],"epss":0.00345,"epssPercentile":0.27982,"ingestedAt":"2026-06-26T16:43:14.610Z","slug":"CVE-2026-48166","body":"## Overview\n\nThe login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email addresses. The impact is limited to disclosing whether an account exists for a given email.\n\n## Affected packages\n\n- `filament/filament >= 4.0.0, <= 4.11.4`\n- `filament/filament >= 5.0.0, <= 5.6.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `filament/filament 4.11.5`\n- `filament/filament 5.6.5`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}