CVE-2026-84307: CWE-204: Observable Response Discrepancy in filamentphp filament
Description
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel(). For an account that canAccessPanel() denies, submitting the correct password renders the MFA challenge while an incorrect password returns the generic authentication failure, allowing an unauthenticated attacker to confirm whether a candidate password is valid for that account. When email-based MFA is configured, the correct-password path also sends a login code to the account holder. The issue applies only to accounts that have MFA enabled and are denied panel access. Authentication is not bypassed because canAccessPanel() still runs after the challenge, and no session is created. This issue is fixed in versions 4.12.5 and 5.7.5.
CVSS v3.1
Score 3.7low
Affected software
filamentphp
filament
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The filamentphp filament package contains a vulnerability (CVE-2026-84307) in the authentication flow within packages/panels/src/Auth/Pages/Login.php. From versions 4.0.0 up to but not including 4.12.5 and 5.7.5, the multi-factor authentication (MFA) challenge is presented before the canAccessPanel() authorization check. For accounts denied panel access but with MFA enabled, submitting a correct password triggers the MFA challenge and sends a login code when email-based MFA is configured, whereas an incorrect password returns a generic authentication failure. This discrepancy allows an unauthenticated attacker to confirm if a candidate password is valid for that account. Authentication is not bypassed since canAccessPanel() still runs after the MFA challenge and no session is created. The vulnerability is fixed in versions 4.12.5 and 5.7.5.
Potential Impact
An unauthenticated attacker can confirm valid passwords for accounts with MFA enabled but denied panel access by observing different responses to correct versus incorrect password submissions. This information disclosure could aid in password guessing attacks. However, the vulnerability does not allow bypassing authentication or gaining unauthorized access, and no session is created during the process.
Mitigation Recommendations
This issue is fixed in filamentphp filament versions 4.12.5 and 5.7.5. Users should upgrade to these versions or later to remediate the vulnerability. No other mitigation or temporary workaround is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-01T16:17:43.078Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a972608acd9273b49191606
Added to database: 09/01/2026, 19:22:48 UTC
Last enriched: 09/07/2026, 13:45:43 UTC
Last updated: 10/17/2026, 18:48:23 UTC
Views: 80
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.