GHSA-7M6H-RG42-M449 Filament: Multi-factor authentication (app) management actions do not require password reauthentication

App-based multi-factor authentication management actions did not consistently require the user to confirm their current password. In particular, an authenticated session could set up app-based MFA and obtain recovery codes without password reauthentication. Disabling app-based MFA and regeneratin...

EUVD-2026-91055

Filament: Multi-factor authentication app management actions do not require password reauthentication...

CVE-2026-104181

The Filament full-stack components for Laravel are vulnerable in versions 4.0.0 through 4.13.3 and 5.8.3 . The root cause is that app-based multi-factor authentication (MFA) management actions do not consistently require the current password for confirmation. An attacker with access to an authent...

CVE-2026-104181 Filament: Multi-factor authentication (app) management actions do not require password reauthentication

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication management actions do not consistently require confirmation of the current password. An attacker with access to an authenticated user...

PT-2026-104009

Name of the Vulnerable Software and Affected Versions Filament versions 4.0.0 through 4.13.2 Filament versions 5.0.0 through 5.8.2 Description App-based multi-factor authentication MFA management actions do not consistently require confirmation of the current password. An attacker with access to ...

Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled

A flaw in the challenge handling for app-based multi-factor authentication allows the second factor to be bypassed. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled...

CVE-2026-77567 Filament: App-based MFA can be bypassed when recovery codes are enabled

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor...

Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission

A flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. If an attacker gains access to both the user's...

CVE-2026-48505

Filament’s MFA recovery-code handling (versions 4.0.0–4.11.5 and 5.6.5) allows the same recovery code to be reused under concurrent submissions. When recovery codes are enabled, an attacker with the user’s password and codes can establish multiple authenticated sessions per code, extending access...

PT-2026-51391

Name of the Vulnerable Software and Affected Versions Filament versions 4.0.0 through 4.11.4 Filament versions prior to 5.6.5 Description A flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused via concurrent submission. This...

Authentication Bypass Using an Alternate Path or Channel

Overview filament/filament is an A collection of full-stack components for accelerated Laravel app development. Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel due to the handling of recovery codes for app-based multi-factor...

CVE-2025-67507

Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.3.0 contain a flaw in the handling of recovery codes for app-based multi-factor authentication, allowing the same recovery code to be reused indefinitely. This issue does not affect...

GHSA-PVCV-Q3Q7-266G Filament multi-factor authentication (app) recovery codes can be used multiple times

A flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused indefinitely. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. If an attacker gains access to both the user's password and...

PT-2025-50298

Name of the Vulnerable Software and Affected Versions Filament versions 4.0.0 through 4.3.0 Description Filament, a collection of full-stack components for accelerated Laravel development, has an issue in how it manages recovery codes for application-based multi-factor authentication. The flaw...

CVE-2024-40750

Linksys Velop Pro 6E 1.0.8 MX62001.0.8.215731 and 7 1.0.10.215314 devices send cleartext Wi-Fi passwords over the public Internet during app-based installation...

CVE-2024-40750

Linksys Velop Pro 6E 1.0.8 MX62001.0.8.215731 and 7 1.0.10.215314 devices send cleartext Wi-Fi passwords over the public Internet during app-based installation...

CVE-2024-40750

Linksys Velop Pro 6E 1.0.8 MX62001.0.8.215731 and 7 1.0.10.215314 devices send cleartext Wi-Fi passwords over the public Internet during app-based installation...

CVE-2024-40750

Linksys Velop Pro 6E 1.0.8 MX62001.0.8.215731 and 7 1.0.10.215314 devices send cleartext Wi-Fi passwords over the public Internet during app-based installation...

CVE-2024-40750: Cleartext Storage of Sensitive Information

Linksys Velop Pro 6E 1.0.8 MX62001.0.8.215731 and 7 1.0.10.215314 devices send cleartext Wi-Fi passwords over the public Internet during app-based installation...

CVE-2024-40750

The Linksys Velop Pro 6E wireless router is vulnerable in versions 1.0.8 MX6200_1.0.8.215731 and 1.0.10.215314 . The root cause is the transmission of cleartext Wi-Fi passwords over the public Internet during an app-based installation process. This exposure could allow unauthorized actors to inte...