CVE-2026-84306 Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses AppAuthentication::verifyCode with a used-code cache key derived from both the app authentication secret an...

PT-2026-84401

Name of the Vulnerable Software and Affected Versions Filament versions prior to 4.12.5 Filament versions prior to 5.7.5 Description The login page presents the multi-factor authentication MFA challenge before evaluating the canAccessPanel function. For accounts where canAccessPanel denies access...

CVE-2026-84307: Observable Response Discrepancy

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel. For an account that canAccessPanel denies,...

PT-2026-84400

Name of the Vulnerable Software and Affected Versions Filament versions prior to 4.12.6 Filament versions prior to 5.7.6 Description An issue exists in the handling of one-time codes for app-based multi-factor authentication MFA. The AppAuthentication::verifyCode function uses a cache key derived...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix Netscaler_Application_Delivery_Controller

CitrixBleedCVE-2026-8452-2025-5777 CitrixBleed Exploit To...

Malicious code in ozturk-mfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99e9596887f3f2f79c96c517c99990def7caa32883f97e9486ed2b52e1e90cdf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mfa-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3afbd77114dc45ac9259720ffd355659d0442c917aff5a734d9ea0ca337cba77 On require'mfa-js', lib/cache.js executes a Windows-gated IIFE that downloads a JavaScript payload from...

MAL-2026-15493 Malicious code in ozturk-mfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99e9596887f3f2f79c96c517c99990def7caa32883f97e9486ed2b52e1e90cdf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15492 Malicious code in mfa-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3afbd77114dc45ac9259720ffd355659d0442c917aff5a734d9ea0ca337cba77 On require'mfa-js', lib/cache.js executes a Windows-gated IIFE that downloads a JavaScript payload from...

BIT-KEYCLOAK-2026-3429 Org.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest api

A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtained a victim’s password can delete the victim’s registered...

Improper Authentication

Overview filament/filament is an A collection of full-stack components for accelerated Laravel app development. Affected versions of this package are vulnerable to Improper Authentication in the authentication process when recovery codes are enabled. An attacker can gain unauthorized access by...

CVE-2026-77567

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor...

CVE-2026-77567 Filament: App-based MFA can be bypassed when recovery codes are enabled

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor...

CVE-2026-77567 Filament: App-based MFA can be bypassed when recovery codes are enabled

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor...

CVE-2026-77567 Filament: App-based MFA can be bypassed when recovery codes are enabled

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor...

CVE-2026-77567

CVE-2026-77567 affects Filament , a full-stack component library for Laravel development. Prior to versions 4.12.0 and 5.7.0 , incorrect challenge-form required-field handling allows app-based multi-factor authentication (MFA) to be bypassed when recovery codes are enabled. Email-based MFA is not...

PT-2026-81029

Name of the Vulnerable Software and Affected Versions Filament versions prior to 4.12.0 Filament versions prior to 5.7.0 Description Incorrect handling of required fields in the challenge form allows the bypass of app-based multi-factor authentication when recovery codes are enabled. Email-based...

CVE-2026-73337

Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...

EUVD-2026-61029

Joomla! Core - 20260807 - MFA Authentication Bypass in Joomla 4.0.0-5.4.7 and 6.0.0-6.1.2 - Insufficient state checks lead to a vector that allows to bypass 2FA checks...

CVE-2026-73337

Joomla! Core versions 4.0.0–5.4.7 and 6.0.0–6.1.2 contain an insufficient state-check flaw in MFA authentication, allowing 2FA bypass (CVSS 8.2 HIGH, integrity impact). No exploitation or patch version details are provided in the documents.