Filamentphp's filament component has a concurrency flaw in handling recovery codes for app-based multi-factor authentication. From versions 4.0.0 until 4.11.5 and 5.6.5, recovery codes intended for single use can be reused multiple times if submitted concurrently. This improper synchronization (race condition) allows an attacker with access to both the user's password and recovery codes to gain multiple authenticated sessions per recovery code, extending their access window beyond the intended single-use limitation. Email-based MFA is not affected. The issue is resolved in versions 4.11.5 and 5.6.5.

An attacker who has obtained both the user's password and their recovery codes can exploit this race condition to reuse recovery codes multiple times concurrently, resulting in multiple authenticated sessions per recovery code. This effectively extends the attacker's access duration and session count beyond what is expected from single-use recovery codes, increasing the risk of unauthorized persistent access.

This vulnerability is fixed in filament versions 4.11.5 and 5.6.5. Users should upgrade to these versions or later to remediate the issue. There is no indication of a temporary workaround or alternative mitigation. Patch status is not explicitly confirmed in the vendor advisory, but the description states the issue is fixed in these versions.