EUVD-2026-38393
GHSA-5w46-g9pq-wh6f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible unauthenticated login endpoint with observable timing leak; limited confidentiality impact (email existence only), no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, the login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email addresses. The impact is limited to disclosing whether an account exists for a given email. This vulnerability is fixed in 4.11.5 and 5.6.5.
AnalysisAI
Filament's login page leaks account existence through a measurable timing side-channel, allowing unauthenticated remote attackers to enumerate registered email addresses. Versions 4.0.0 through 4.11.4 and 5.0.0 through 5.6.4 of this widely-used Laravel full-stack component library are affected. The impact is confined to account enumeration - no credentials, session tokens, or other data are exposed - but the disclosed information can seed targeted phishing or credential-stuffing campaigns. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
CWE-208 (Observable Timing Discrepancy) arises when an application takes measurably different amounts of time to process requests depending on a secret condition - in this case, whether a submitted email address corresponds to a registered account. Filament (cpe:2.3:a:filamentphp:filament:*:*:*:*:*:*:*:*) is a collection of full-stack Blade and Livewire components for Laravel. The likely root cause is a non-constant-time code path in the authentication flow: when a user exists, the application proceeds to hash and compare passwords; when the user does not exist, it may short-circuit that expensive operation, producing a response-time delta detectable over the network. This class of flaw is well-documented in authentication libraries and is typically fixed by ensuring a dummy hash comparison is always performed regardless of lookup result.
RemediationAI
Upgrade to Filament 4.11.5 (for the 4.x branch) or 5.6.5 (for the 5.x branch), which are confirmed fixed versions per the GitHub Security Advisory at https://github.com/filamentphp/filament/security/advisories/GHSA-5w46-g9pq-wh6f. If immediate upgrade is not possible, a compensating control is to introduce artificial response-time normalization at the web server or reverse proxy layer (e.g., enforcing a minimum response time for login endpoints), though this may degrade user experience and does not address the root cause in the application code. Rate-limiting and IP-based throttling of the login endpoint will not eliminate the timing oracle but will significantly increase the cost of large-scale enumeration. Note that these mitigations are imperfect substitutes for the patch.
App-based multi-factor authentication in Filament (the Laravel admin panel framework) can be fully bypassed by an attack
Recovery code reuse in Filament (Laravel admin panel framework) versions 4.0.0 through 4.11.4 and 5.0.0 through 5.6.4 al
Unauthenticated arbitrary file upload in Filament (Laravel component framework) versions 3.0.0 through 3.3.51, 4.x throu
Stored cross-site scripting in Filament's ImageColumn and ImageEntry components allows low-privileged authenticated atta
Filament is a collection of full-stack components for Laravel development. Rated medium severity (CVSS 6.1), this vulner
Same weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today