CVE-2026-48505: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in filamentphp filament
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, a flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. If an attacker gains access to both the user's password and their recovery codes, they get two authenticated sessions per recovery code burned instead of one, or more if they batch the parallel submissions wider, materially extending the attacker's window of access compared to what the single-use guarantee implies. This vulnerability is fixed in 4.11.5 and 5.6.5.
AI Analysis
Technical Summary
Filamentphp's filament component has a concurrency flaw in handling recovery codes for app-based multi-factor authentication. From versions 4.0.0 until 4.11.5 and 5.6.5, recovery codes intended for single use can be reused multiple times if submitted concurrently. This improper synchronization (race condition) allows an attacker with access to both the user's password and recovery codes to gain multiple authenticated sessions per recovery code, extending their access window beyond the intended single-use limitation. Email-based MFA is not affected. The issue is resolved in versions 4.11.5 and 5.6.5.
Potential Impact
An attacker who has obtained both the user's password and their recovery codes can exploit this race condition to reuse recovery codes multiple times concurrently, resulting in multiple authenticated sessions per recovery code. This effectively extends the attacker's access duration and session count beyond what is expected from single-use recovery codes, increasing the risk of unauthorized persistent access.
Mitigation Recommendations
This vulnerability is fixed in filament versions 4.11.5 and 5.6.5. Users should upgrade to these versions or later to remediate the issue. There is no indication of a temporary workaround or alternative mitigation. Patch status is not explicitly confirmed in the vendor advisory, but the description states the issue is fixed in these versions.
CVE-2026-48505: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in filamentphp filament
Description
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, a flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. If an attacker gains access to both the user's password and their recovery codes, they get two authenticated sessions per recovery code burned instead of one, or more if they batch the parallel submissions wider, materially extending the attacker's window of access compared to what the single-use guarantee implies. This vulnerability is fixed in 4.11.5 and 5.6.5.
CVSS v3.1
Score 7.4high
Affected software
pkg:composer/filamentphp/filamentRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Filamentphp's filament component has a concurrency flaw in handling recovery codes for app-based multi-factor authentication. From versions 4.0.0 until 4.11.5 and 5.6.5, recovery codes intended for single use can be reused multiple times if submitted concurrently. This improper synchronization (race condition) allows an attacker with access to both the user's password and recovery codes to gain multiple authenticated sessions per recovery code, extending their access window beyond the intended single-use limitation. Email-based MFA is not affected. The issue is resolved in versions 4.11.5 and 5.6.5.
Potential Impact
An attacker who has obtained both the user's password and their recovery codes can exploit this race condition to reuse recovery codes multiple times concurrently, resulting in multiple authenticated sessions per recovery code. This effectively extends the attacker's access duration and session count beyond what is expected from single-use recovery codes, increasing the risk of unauthorized persistent access.
Mitigation Recommendations
This vulnerability is fixed in filament versions 4.11.5 and 5.6.5. Users should upgrade to these versions or later to remediate the issue. There is no indication of a temporary workaround or alternative mitigation. Patch status is not explicitly confirmed in the vendor advisory, but the description states the issue is fixed in these versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-21T16:18:10.618Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a39b299eed863c81e7e85d7
Added to database: 06/22/2026, 22:09:29 UTC
Last enriched: 06/22/2026, 22:24:24 UTC
Last updated: 08/05/2026, 00:41:15 UTC
Views: 66
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.