---
id: CVE-2026-84306
title: >-
  Filament is a collection of full-stack components for accelerated Laravel
  development
summary: >-
  Filament is a collection of full-stack components for accelerated Laravel
  development. From 4.0.0 until 4.12.6 and 5.7.6,
  packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses
  AppAuthentication::verifyCode() with a used-cod…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-294
vendor: filament
product: filament/filament
affected:
  - 'filament/filament >= 4.0.0, < 4.12.6'
  - 'filament/filament >= 5.0.0, < 5.7.6'
patched:
  - filament/filament 4.12.6
  - filament/filament 5.7.6
published: '2026-09-01'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84306'
references:
  - url: >-
      https://github.com/filamentphp/filament/commit/b6bde8572bcac75d4f5b4ec892ba7b9e91e0ab4d
    label: security-advisories@github.com
  - url: 'https://github.com/filamentphp/filament/pull/20335'
    label: security-advisories@github.com
  - url: 'https://github.com/filamentphp/filament/releases/tag/v4.12.6'
    label: security-advisories@github.com
  - url: 'https://github.com/filamentphp/filament/releases/tag/v5.7.6'
    label: security-advisories@github.com
  - url: >-
      https://github.com/filamentphp/filament/security/advisories/GHSA-r3j6-gpjw-qfjr
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-r3j6-gpjw-qfjr'
tags:
  - nvd
  - ghsa
  - composer
epss: 0.00448
epssPercentile: 0.3625
aliases:
  - GHSA-r3j6-gpjw-qfjr
ecosystem: composer
ingestedAt: '2026-09-01T21:32:41.303Z'
---

## Overview

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses AppAuthentication::verifyCode() with a used-code cache key derived from both the app authentication secret and the submitted TOTP code. This isolates the newest accepted timestep by code instead of by secret, allowing a previously issued app-based MFA code to be accepted after a newer code has already been used. Reuse of the exact same code was already prevented, but another code inside the accepted time window remained usable. An attacker who obtains the target account's password and one app-based MFA code can use that code for the remainder of the configured window, which is approximately four minutes with the default settings, even after the legitimate account holder logs in with a newer code. Email-based MFA is not affected. This issue is fixed in versions 4.12.6 and 5.7.6.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-84306)

Affected packages:

- `filament/filament >= 4.0.0, < 4.12.6`
- `filament/filament >= 5.0.0, < 5.7.6`

Patched in:

- `filament/filament 4.12.6`
- `filament/filament 5.7.6`

Source: https://github.com/advisories/GHSA-r3j6-gpjw-qfjr