CVE-2026-104181

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication management actions do not consistently require confirmation of the current password. An attacker with access to an authenticated user session can set up app-based MFA and obtain recovery codes, or disable app-based MFA and regenerate recovery codes by supplying an existing app code or recovery code, without knowing the account password. Email-based MFA is not affected, and the issue does not independently permit an unauthenticated sign-in, but changing the app-MFA configuration may lock the legitimate user out. This issue is fixed in versions 4.13.3 and 5.8.3.

• CWE-306

• https://github.com/filamentphp/filament/commit/6d4dae6d7a94ce5aefd7ed4dc836acb0e6b71bb1
• https://github.com/filamentphp/filament/pull/20522
• https://github.com/filamentphp/filament/releases/tag/v4.13.3
• https://github.com/filamentphp/filament/releases/tag/v5.8.3
• https://github.com/filamentphp/filament/security/advisories/GHSA-7m6h-rg42-m449

Published

Oct 1, 2026

Last Modified

Oct 1, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104018An improper privilege management vulnerability (CWE-269) exi…8.8
• CVE-2026-104020Uncontrolled recursion in the Ion reader in Amazon Ion Pytho…7.5
• CVE-2026-104056Authlib version 1.7.2 and below contains a vulnerability whe…
• CVE-2026-104057Podgrab contains an unauthenticated denial-of-service vulner…7.5
• CVE-2026-104058Podgrab contains a missing authentication vulnerability in w…5.3
• CVE-2026-104059Lektor 3.3.14 and 3.4.0b15 contains a cross-site request for…8.1
• CVE-2026-104182stream-json is a micro-library of stream components for proc…6.2
• CVE-2026-104183stream-json is a micro-library of stream components for proc…5.1
• CVE-2026-1042The WP Hello Bar plugin for WordPress is vulnerable to Store…4.4
• CVE-2026-10420Untrusted pointer dereference vulnerability in Samsung Open …5.5
• CVE-2026-104286An improper limitation of a pathname to a restricted directo…9.8
• CVE-2026-1043The PostmarkApp Email Integrator plugin for WordPress is vul…4.4