EUVD-2026-65118

Filament: Multi-factor authentication app can be bypassed when recovery codes are enabled...

CVE-2026-77567

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor...

CVE-2026-77567 Filament: App-based MFA can be bypassed when recovery codes are enabled

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor...

CVE-2026-77567 Filament: App-based MFA can be bypassed when recovery codes are enabled

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor...

CVE-2026-77567

CVE-2026-77567 affects Filament , a full-stack component library for Laravel development. Prior to versions 4.12.0 and 5.7.0 , incorrect challenge-form required-field handling allows app-based multi-factor authentication (MFA) to be bypassed when recovery codes are enabled. Email-based MFA is not...

PT-2026-81029

Name of the Vulnerable Software and Affected Versions Filament versions prior to 4.12.0 Filament versions prior to 5.7.0 Description Incorrect handling of required fields in the challenge form allows the bypass of app-based multi-factor authentication when recovery codes are enabled. Email-based...

CVE-2026-45129

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

CVE-2026-45129 MyBB: ACP Recovery Codes CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

CVE-2026-45129

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

EUVD-2026-61019

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

CVE-2026-45129

In MyBB versions prior to 1.8.40, the Admin CP Recovery Codes module at admin/modules/home/preferences.php regenerates 2FA recovery codes on GET requests without CSRF protection, allowing same-site attackers to force a victim administrator to rotate their recovery codes via a crafted URL. Exploit...

CVE-2026-45129 MyBB: ACP Recovery Codes CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

PT-2026-77182

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

CVE-2026-72917

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

PT-2026-69986

Name of the Vulnerable Software and Affected Versions AnythingLLM versions 1.0.0 through 1.15.0 Description The unauthenticated account-recovery flow in the server/utils/PasswordRecovery/index.js file uses the recoverAccount function to deduplicate recoveryCodes values before they are trimmed. Th...

GHSA-JPPW-R5J3-XF7X Statamic CMS exposes two-factor recovery codes through dynamic Antlers rendering

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the twofactorrecoverycodes handle that returns the user's raw two-factor recovery codes with no access restriction: if $handle === 'twofactorrecoverycodes' return new...

CVE-2026-71293

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction...

CVE-2026-71293 Statamic CMS Unguarded Exposure of 2FA Recovery Codes via Antlers current_user Variable

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction...

CVE-2026-71293

CVE-2026-71293 (Statamic CMS) : The AugmentedUser::get() handler exposes a dedicated case for the two_factor_recovery_codes handle, returning raw 2FA recovery codes without access restrictions. This bypass is not mitigated by password-hash exclusions, and two_factor_recovery_codes is not protecte...

EUVD-2026-53378

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the twofactorrecoverycodes handle that returns the user's raw two-factor recovery codes with no access restriction: if $handle === 'twofactorrecoverycodes' return new...