{"id":"CVE-2026-77567","title":"Filament is a collection of full-stack components for accelerated Laravel development","summary":"Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when …","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-287"],"vendor":"filament","product":"filament/filament","affected":["filament/filament >= 4.0.0, < 4.12.0","filament/filament >= 5.0.0, < 5.7.0"],"patched":["filament/filament 4.12.0","filament/filament 5.7.0"],"published":"2026-08-24","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:06:39.057","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77567","references":[{"url":"https://github.com/filamentphp/filament/commit/45534a6f87f50ac6df3b43680bb33f8da9ef207b","label":"security-advisories@github.com"},{"url":"https://github.com/filamentphp/filament/releases/tag/v4.12.0","label":"security-advisories@github.com"},{"url":"https://github.com/filamentphp/filament/releases/tag/v5.7.0","label":"security-advisories@github.com"},{"url":"https://github.com/filamentphp/filament/security/advisories/GHSA-52xp-w8hr-xv3c","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77567"},{"url":"https://github.com/advisories/GHSA-52xp-w8hr-xv3c"}],"tags":["nvd","ghsa","composer"],"epss":0.00304,"epssPercentile":0.23357,"aliases":["GHSA-52xp-w8hr-xv3c"],"ecosystem":"composer","ingestedAt":"2026-09-01T21:32:41.388Z","slug":"CVE-2026-77567","body":"## Overview\n\nFilament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected. This issue is fixed in versions 4.12.0 and 5.7.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-77567)\n\nAffected packages:\n\n- `filament/filament >= 4.0.0, < 4.12.0`\n- `filament/filament >= 5.0.0, < 5.7.0`\n\nPatched in:\n\n- `filament/filament 4.12.0`\n- `filament/filament 5.7.0`\n\nSource: https://github.com/advisories/GHSA-52xp-w8hr-xv3c","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}