Filament CVE-2026-48505

Exploitation requires four concrete conditions: (1) the target Filament instance must be on an affected version (4.0.0-4.11.4 or 5.0.0-5.6.4); (2) app-based (TOTP) MFA must be enabled - email-based MFA is explicitly unaffected; (3) the recovery-codes feature must be enabled in the MFA configuration; and (4) the attacker must already possess BOTH the victim user's password AND at least one of their unused recovery codes obtained out-of-band (phishing, credential stuffing, prior breach). The attacker must also be able to issue genuinely concurrent HTTP requests against the verification endpoint within the race window - server-side request serialization, aggressive rate-limiting, or a single-worker deployment could narrow or close the window. The flaw does NOT yield initial access on its own and does not bypass the password or recovery-code secrets themselves.

The CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N vector yields 7.4 (High), but real-world risk is substantially lower than the headline number suggests because this is a post-compromise amplification flaw rather than a standalone access vector - exploitation presupposes the attacker already holds the victim's password AND their recovery codes, conditions not modeled in PR:N. The AC:H rating correctly captures the timing-window requirement, and the absence of any KEV listing, EPSS data, or public POC suggests this is not under active exploitation. The practical impact is extending an already-compromised session footprint (one recovery code yields N sessions instead of 1), which matters for forensic containment and credential-rotation windows but does not enable initial access. Conflict to note: the PR:N rating is technically defensible (no Filament-issued credentials are needed for the HTTP submission itself) but is misleading without context, since the attacker must possess out-of-band secrets to even reach the vulnerable code path.

An attacker who has previously phished or otherwise stolen a Filament admin user's password and recovery code set scripts a small concurrent HTTP client (e.g., 10 parallel curl/async requests) to submit the same recovery code to the MFA verification endpoint simultaneously. The race window allows several requests to pass validation before the code is marked consumed, returning multiple valid session cookies the attacker can distribute across IPs to evade single-session anomaly detection. No public POC is currently identified, but the bug class is well-understood and trivially scriptable by anyone with the prerequisite credentials.