CVE-2026-77567— Filament: App-based MFA can be bypassed when recovery codes are enabled
Quick assessment
Affected
filamentphp filament
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Filament 是一套用于加速 Laravel 开发的全栈组件集合。在版本 4.12.0 和 5.7.0 之前，错误的挑战表单必填字段处理方式导致在启用恢复码的情况下，可以绕过基于应用程序的多因素认证（MFA）。基于电子邮件的多因素认证不受此问题影响。该问题已在版本 4.12.0 和 5.7.0 中得到修复。
Possible ATT&CK Techniques 1 AI
T1078.001 · Default Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-77567
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Filament: App-based MFA can be bypassed when recovery codes are enabled
Source: CVE Program / CVE List V5
Vulnerability Description
Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected. This issue is fixed in versions 4.12.0 and 5.7.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| filamentphp | filament | >= 4.0.0, < 4.12.0 | - |
|
II. Public POCs for CVE-2026-77567
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
Qwen3.6-35B-A3B
· 16774 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-77567
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-77567 (1)
Vendor Advisories for CVE-2026-77567 (1)
Vendor Pages for CVE-2026-77567 (2)
-
🔗 Release v5.7.0 · filamentphp/filament · GitHub x_refsource_MISC
-
🔗 Release v4.12.0 · filamentphp/filament · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: filament
-
CVE-2026-55409
Filament: Disabled RichEditor field state can be used for XS -
CVE-2026-48067
Filament: Inconsistent scope enforcement for AttachAction an -
CVE-2026-48167
Filament: Unvalidated ImageColumn and ImageEntry values can -
CVE-2026-48500
Filament: Unauthenticated temporary file upload on auth page -
CVE-2026-48166
Filament: Timing-based user enumeration on login page
Same vendor: filamentphp
-
CVE-2026-55409
Filament: Disabled RichEditor field state can be used for XS -
CVE-2026-48067
Filament: Inconsistent scope enforcement for AttachAction an -
CVE-2026-48167
Filament: Unvalidated ImageColumn and ImageEntry values can -
CVE-2026-48500
Filament: Unauthenticated temporary file upload on auth page -
CVE-2026-48166
Filament: Timing-based user enumeration on login page
Same weakness: CWE-287
-
CVE-2026-65633
Purpose-limited JWT accepted as full bearer authentication i -
CVE-2026-66908
Apache Camel: Camel-platform-http-main: when JWT authenticat -
CVE-2026-78168
EFM ipTIME T24000M Session Validation httpcon_check_session_ -
CVE-2026-78167
EFM ipTIME T16000M Session Validation httpcon_check_session_ -
CVE-2026-17142
Vulnerabilities in IBM AIX and PowerVM VIOS
V. Comments for CVE-2026-77567
No comments yet