CVE-2026-77567

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77567", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-20T20:35:30.147Z", "datePublished": "2026-08-24T20:10:58.326Z", "dateUpdated": "2026-08-27T14:17:29.291Z"}, "containers": {"cna": {"title": "Filament: App-based MFA can be bypassed when recovery codes are enabled", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/filamentphp/filament/security/advisories/GHSA-52xp-w8hr-xv3c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/filamentphp/filament/security/advisories/GHSA-52xp-w8hr-xv3c"}, {"name": "https://github.com/filamentphp/filament/commit/45534a6f87f50ac6df3b43680bb33f8da9ef207b", "tags": ["x_refsource_MISC"], "url": "https://github.com/filamentphp/filament/commit/45534a6f87f50ac6df3b43680bb33f8da9ef207b"}, {"name": "https://github.com/filamentphp/filament/releases/tag/v4.12.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/filamentphp/filament/releases/tag/v4.12.0"}, {"name": "https://github.com/filamentphp/filament/releases/tag/v5.7.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/filamentphp/filament/releases/tag/v5.7.0"}], "affected": [{"vendor": "filamentphp", "product": "filament", "versions": [{"version": ">= 4.0.0, < 4.12.0", "status": "affected"}, {"version": ">= 5.0.0, < 5.7.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-24T20:10:58.326Z"}, "descriptions": [{"lang": "en", "value": "Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected. This issue is fixed in versions 4.12.0 and 5.7.0."}], "source": {"advisory": "GHSA-52xp-w8hr-xv3c", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-27T14:17:17.322684Z", "id": "CVE-2026-77567", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-27T14:17:29.291Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77567", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-27T14:17:17.322684Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-27T14:17:23.963Z"}}], "cna": {"title": "Filament: App-based MFA can be bypassed when recovery codes are enabled", "source": {"advisory": "GHSA-52xp-w8hr-xv3c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "filamentphp", "product": "filament", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.12.0"}, {"status": "affected", "version": ">= 5.0.0, < 5.7.0"}]}], "references": [{"url": "https://github.com/filamentphp/filament/security/advisories/GHSA-52xp-w8hr-xv3c", "name": "https://github.com/filamentphp/filament/security/advisories/GHSA-52xp-w8hr-xv3c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/filamentphp/filament/commit/45534a6f87f50ac6df3b43680bb33f8da9ef207b", "name": "https://github.com/filamentphp/filament/commit/45534a6f87f50ac6df3b43680bb33f8da9ef207b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/filamentphp/filament/releases/tag/v4.12.0", "name": "https://github.com/filamentphp/filament/releases/tag/v4.12.0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/filamentphp/filament/releases/tag/v5.7.0", "name": "https://github.com/filamentphp/filament/releases/tag/v5.7.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected. This issue is fixed in versions 4.12.0 and 5.7.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-24T20:10:58.326Z"}}}, "cveMetadata": {"cveId": "CVE-2026-77567", "state": "PUBLISHED", "dateUpdated": "2026-08-27T14:17:29.291Z", "dateReserved": "2026-08-20T20:35:30.147Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-24T20:10:58.326Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "filament", "vendor": "filamentphp", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.12.0"}, {"status": "affected", "version": ">= 5.0.0, < 5.7.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected. This issue is fixed in versions 4.12.0 and 5.7.0."}, {"lang": "es", "value": "Filament es una colecci\u00f3n de componentes full-stack para el desarrollo acelerado de Laravel. Antes de las versiones 4.12.0 y 5.7.0, el manejo incorrecto de los campos obligatorios del formulario de desaf\u00edo permite que la autenticaci\u00f3n multifactor basada en aplicaci\u00f3n sea eludida cuyo los c\u00f3digos de recuperaci\u00f3n est\u00e1n habilitados. La autenticaci\u00f3n multifactor basada en correo electr\u00f3nico no se ve afectada. Este problema est\u00e1 solucionado en las versiones 4.12.0 y 5.7.0."}], "id": "CVE-2026-77567", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77567", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-27T14:17:17.322684Z", "version": "2.0.3"}}]}, "published": "2026-08-24T21:17:48.150", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/filamentphp/filament/commit/45534a6f87f50ac6df3b43680bb33f8da9ef207b"}, {"source": "security-advisories@github.com", "url": "https://github.com/filamentphp/filament/releases/tag/v4.12.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/filamentphp/filament/releases/tag/v5.7.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/filamentphp/filament/security/advisories/GHSA-52xp-w8hr-xv3c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.12.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.7.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "filament", "source": "cna", "vendor": "filamentphp"}, "product": "filament", "vendor": "filamentphp"}], "created": "2026-08-24T21:45:03.375902+00:00", "updated": "2026-08-24T21:45:03.565592+00:00", "vendors": ["filamentphp", "filamentphp$PRODUCT$filament"]}