Filament CVE-2025-67507

Applies only to Filament panels (versions 4.0.0 through 4.3.0) that use app-based (TOTP) multi-factor authentication with the recovery-codes feature enabled; email-based MFA is explicitly unaffected and deployments without recovery codes are not exploitable. The decisive prerequisite is that the attacker must already hold the victim's valid password and at least one of their recovery codes - the flaw does not grant initial credential access, it makes a compromised recovery code reusable indefinitely instead of one-time. Primary limiting factors: dependence on prior compromise of both credentials and recovery codes (reflected in CVSS AC:H), the non-default requirement that recovery codes be enabled, and the specific affected version window patched in 4.3.1.

Signals here point to a real but conditional risk rather than a widespread, easily exploitable flaw. The NVD CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H, score 8.1) rates this High, but the AC:H component and the advisory text reveal the true gating factor: an attacker must already possess BOTH the victim's password AND their valid recovery codes. This makes the PR:N labeling technically defensible (the attacker holds no legitimate account of their own) yet somewhat misleading in practice - exploitation is predicated on a prior credential/recovery-code compromise, so this is a defense-in-depth failure that nullifies the second factor rather than a standalone remote account-takeover primitive. EPSS is low at 0.34% (26th percentile), consistent with no public weaponized exploit and the required preconditions. The CVE is NOT in CISA KEV, and no POC/exploit code is present - only the vendor patch diff and a regression test. No SSVC decision record was provided in the input. Bottom line: the CVSS-High rating overstates day-to-day urgency; realistic risk is moderate and scoped to environments where an attacker has already stolen recovery codes, in which case the flaw turns those codes into a permanent, reusable MFA bypass. The low EPSS and absence of KEV/POC align with that conditional profile rather than contradicting it.

An attacker who has already phished or otherwise stolen a Filament panel user's password and recovery codes logs in and, when prompted for app-based MFA, submits one of the stolen recovery codes. Because the code is never invalidated after use, the attacker can repeatedly authenticate as the victim across future sessions without ever needing the TOTP app. No public exploit code exists; exploitation is manual and requires prior possession of valid credentials and recovery codes.