---
id: CVE-2026-48166
title: 'Filament: Timing-based user enumeration on login page'
summary: 'Filament: Timing-based user enumeration on login page'
severity: medium
cvss: 5.3
cwe:
  - CWE-208
vendor: filament
product: filament/filament
ecosystem: composer
affected:
  - 'filament/filament >= 4.0.0, <= 4.11.4'
  - 'filament/filament >= 5.0.0, <= 5.6.4'
patched:
  - filament/filament 4.11.5
  - filament/filament 5.6.5
published: '2026-06-23'
updated: '2026-06-23'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-5w46-g9pq-wh6f'
references:
  - url: >-
      https://github.com/filamentphp/filament/security/advisories/GHSA-5w46-g9pq-wh6f
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-48166'
  - url: 'https://github.com/advisories/GHSA-5w46-g9pq-wh6f'
tags:
  - ghsa
  - composer
epss: 0.00345
epssPercentile: 0.28092
ingestedAt: '2026-06-26T16:43:14.610Z'
---

## Overview

The login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email addresses. The impact is limited to disclosing whether an account exists for a given email.

## Affected packages

- `filament/filament >= 4.0.0, <= 4.11.4`
- `filament/filament >= 5.0.0, <= 5.6.4`

## Remediation

Upgrade to a patched release:

- `filament/filament 4.11.5`
- `filament/filament 5.6.5`