Filament CVE-2026-48166

The Filament login page must be network-accessible to the attacker - a default condition for any publicly-facing Filament application. No authentication, special permissions, or non-default configuration is required beyond the presence of a vulnerable Filament version (4.0.0-4.11.4 or 5.0.0-5.6.4) with its login panel exposed. The primary limiting factor is that network jitter can obscure small timing differences, requiring the attacker to send statistically significant volumes of repeated requests to achieve reliable enumeration - this makes the attack noisier and more detectable by anomaly-based monitoring on the login endpoint.

The CVSS 3.1 score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N is proportionate to the actual impact. The attack is fully unauthenticated, requires no user interaction, and is network-accessible - traits that lower the barrier to exploitation. However, the confidentiality impact is strictly limited to whether an account exists for a given email address; no sensitive data such as password hashes, session tokens, or PII are disclosed. No EPSS data was provided in the intelligence package, and the absence of a KEV listing and public POC code means this is a theoretical attack requiring deliberate exploitation rather than an immediate emergency. The real-world risk is moderate for applications where account existence itself is sensitive (e.g., medical, financial, or confidential-community platforms) and low for applications where registration is publicly visible. No conflicting signals were identified between the CVSS vector and the description.

An attacker submits hundreds of login requests to the Filament login endpoint using a list of candidate email addresses, recording the HTTP response time for each. Requests for registered email addresses consistently take longer (due to the password hashing step) than those for non-existent accounts, allowing the attacker to partition the list into confirmed and unconfirmed accounts. No public exploit code has been identified at time of analysis, but this class of attack is well-understood and implementable with standard HTTP tooling.