What is the CVSS score of CVE-2026-48505?

CVE-2026-48505 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Filament are affected by CVE-2026-48505?

Organizations using Filament versions 4.0.0-4.11.4 or 5.0.0-5.6.4 face a critical gap in MFA security: attackers who obtain both a user's password and recovery codes can exploit a race condition to…. A patch is available.

How to fix or mitigate CVE-2026-48505?

Within 24 hours: Inventory all Filament installations and identify which versions (4.0.0-4.11.4 or 5.0.0-5.6.4) are deployed. Within 7 days: Test patches in a staging environment and validate compatibility with existing configurations; plan deployment schedule. Within 30 days: Upgrade all affected instances to Filament 4.11.5 (v4 branch) or 5.6.5 (v5 branch) and verify MFA recovery code functionality post-deployment.

Filament CVE-2026-48505

EUVD-2026-38392 HIGH

Race Condition (CWE-362)

2026-06-22 GitHub_M

GHSA-mc5j-f6wx-h9qh

Race Condition Information Disclosure Filament

7.4

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

3.3 LOW

Attacker must already hold password and recovery codes (PR:H); AC:H for race window; impact is session-count amplification only, not new C/I compromise, so C:L/I:L/A:N.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 22, 2026 - 23:02 EUVD

Analysis Generated

Jun 22, 2026 - 22:19 vuln.today

DescriptionCVE.org

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, a flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. If an attacker gains access to both the user's password and their recovery codes, they get two authenticated sessions per recovery code burned instead of one, or more if they batch the parallel submissions wider, materially extending the attacker's window of access compared to what the single-use guarantee implies. This vulnerability is fixed in 4.11.5 and 5.6.5.

AnalysisAI

Recovery code reuse in Filament (Laravel admin panel framework) versions 4.0.0 through 4.11.4 and 5.0.0 through 5.6.4 allows attackers who already possess a victim's password and recovery codes to obtain multiple authenticated sessions per single recovery code by submitting parallel authentication requests. The flaw stems from a TOCTOU race condition (CWE-362) in app-based MFA recovery code validation, undermining the single-use guarantee. No public exploit identified at time of analysis and the vulnerability is fixed in 4.11.5 and 5.6.5.

Technical ContextAI

Filament is a popular open-source TALL-stack (Tailwind, Alpine, Laravel, Livewire) component library used to build admin panels and dashboards on top of Laravel applications, identified by CPE cpe:2.3:a:filamentphp:filament. The vulnerability is a CWE-362 concurrent execution race condition in the MFA recovery-code consumption logic: the code checks whether a recovery code is valid and then marks it as used in non-atomic operations, creating a check-then-act window. By submitting multiple authentication requests in parallel within that window, an attacker can pass the validation step multiple times before the 'consumed' state is written, allowing the same recovery code to authenticate more than one session. The defect is specific to app-based (TOTP) MFA flows and does not affect email-based MFA, which uses a different verification path.

RemediationAI

Vendor-released patch: upgrade to Filament 4.11.5 (for the 4.x branch) or 5.6.5 (for the 5.x branch) as documented in GHSA-mc5j-f6wx-h9qh at https://github.com/filamentphp/filament/security/advisories/GHSA-mc5j-f6wx-h9qh. If immediate upgrade is not possible, compensating controls include disabling the recovery-codes feature in the Filament MFA configuration (forces users into the standard TOTP flow but locks out anyone who has lost their authenticator), switching the MFA driver to email-based verification which is not affected (trade-off: weaker phishing resistance and dependence on mailbox security), or putting the authentication endpoint behind a rate-limiter or WAF rule that rejects concurrent recovery-code submissions from the same source within a short window (may produce false positives for legitimate retries). After patching, rotate any recovery codes that may have been used during the exposure window and review authentication audit logs for multiple successful logins tied to a single recovery code identifier.