CVE-2026-84306: CWE-294: Authentication Bypass by Capture-replay in filamentphp filament

Filamentphp's filament package versions from 4.0.0 up to but not including 4.12.6 and 5.7.6 contain an authentication bypass vulnerability (CWE-294) in the app-based multi-factor authentication (MFA) implementation. The function AppAuthentication::verifyCode() uses a cache key combining the app authentication secret and the submitted TOTP code to track used codes. However, this approach isolates the newest accepted timestep by code rather than by secret, allowing reuse of a different valid code within the same time window after a newer code has been used. While reuse of the exact same code is prevented, other codes in the accepted time window remain valid. An attacker who has the target account's password and one valid app-based MFA code can reuse that code for the remainder of the configured window (about four minutes by default), even after the legitimate user logs in with a newer code. This vulnerability does not affect email-based MFA. The issue is resolved in filament versions 4.12.6 and 5.7.6.

An attacker who obtains both the target account's password and a single valid app-based MFA code can bypass the intended one-time use restriction of MFA codes within the accepted time window, allowing reuse of an MFA code for approximately four minutes. This weakens the security of the multi-factor authentication mechanism by enabling an attacker to authenticate successfully even after the legitimate user has logged in with a newer code. The confidentiality of the account is at risk. The vulnerability does not affect email-based MFA methods.

This vulnerability is fixed in filament versions 4.12.6 and 5.7.6. Users should upgrade to at least these versions to remediate the issue. No other mitigation or workaround is indicated. Patch status is confirmed by the vendor advisory.