CVE-2026-84306

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses AppAuthentication::verifyCode with a used-code cache key derived from both the app authentication secret an...

CVE-2026-84306 Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses AppAuthentication::verifyCode with a used-code cache key derived from both the app authentication secret an...

CVE-2026-84306 Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses AppAuthentication::verifyCode with a used-code cache key derived from both the app authentication secret an...

PT-2026-84400

Name of the Vulnerable Software and Affected Versions Filament versions prior to 4.12.6 Filament versions prior to 5.7.6 Description An issue exists in the handling of one-time codes for app-based multi-factor authentication MFA. The AppAuthentication::verifyCode function uses a cache key derived...

CVE-2025-55003: Improper Restriction of Excessive Authentication Attempts

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and below, OpenBao's Login Multi-Factor Authentication MFA system allows enforcing MFA using Time-based One Time Password TOTP. Due to...

PT-2023-16755

Name of the Vulnerable Software and Affected Versions SonicOS affected versions not specified Description The issue concerns an improper restriction of excessive MFA attempts in SonicOS SSLVPN, allowing an authenticated attacker to use excessive MFA codes. Recommendations At the moment, there is ...