What is the CVSS score of CVE-2026-77567?

CVE-2026-77567 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Filament are affected by CVE-2026-77567?

Filament, a Laravel admin panel framework, contains a vulnerability in its authentication system that undermines multi-factor authentication protections: attackers who obtain a user's password can…. A patch is available.

How to fix or mitigate CVE-2026-77567?

Within 24 hours: inventory all Filament deployments, verify which use app-based MFA with recovery codes enabled, and review recent admin account access logs for unauthorized activity or authentication anomalies. Within 7 days: conduct a security audit of admin authentication logs for signs of bypass exploitation; consider temporarily disabling recovery codes on sensitive administrative accounts to force direct TOTP-only validation; and review account access policies. Within 30 days: continuously monitor Filament and Laravel security advisories for vendor patch release; develop and test a deployment plan for any released patches; and implement compensating controls if patches remain unavailable.

Filament CVE-2026-77567

EUVD-2026-65118 HIGH

Improper Authentication (CWE-287)

2026-08-24 GitHub_M

Authentication Bypass Filament

8.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

PR:L because first-factor credentials are required to reach the MFA challenge; network-exploitable once credentials are known; no confidentiality/integrity limit once MFA is bypassed.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Aug 24, 2026 - 21:02 EUVD

Source Code Evidence Fetched

Aug 24, 2026 - 20:51 vuln.today

Analysis Generated

Aug 24, 2026 - 20:51 vuln.today

CVE Published

Aug 24, 2026 - 20:10 cve.org

HIGH 8.1

DescriptionCVE.org

Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected. This issue is fixed in versions 4.12.0 and 5.7.0.

AnalysisAI

App-based multi-factor authentication in Filament (the Laravel admin panel framework) can be fully bypassed by an attacker who possesses a user's primary credentials when recovery codes are enabled on the targeted account. Exploiting incorrect required() field logic in the MFA challenge form, an authenticated-first-factor attacker can toggle the recovery code path and submit the MFA form with both the TOTP code and recovery code fields left blank, passing validation and gaining full account access. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Obtain target panel credentials via phishing or credential stuffing

Delivery

Submit first-factor login (email + password)

Exploit

Reach app-based MFA challenge page

Install

Toggle 'use recovery code' UI option

Submit form with both TOTP and recovery code fields blank

Execute

Bypass MFA validation

Impact

Gain full authenticated panel session