CVE-2026-84307

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel(). For an account that canAccessPanel() denies, submitting the correct password renders the MFA challenge while an incorrect password returns the generic authentication failure, allowing an unauthenticated attacker to confirm whether a candidate password is valid for that account. When email-based MFA is configured, the correct-password path also sends a login code to the account holder. The issue applies only to accounts that have MFA enabled and are denied panel access. Authentication is not bypassed because canAccessPanel() still runs after the challenge, and no session is created. This issue is fixed in versions 4.12.5 and 5.7.5.

• CWE-204

• https://github.com/filamentphp/filament/commit/ad5aacbc6d089b3dd7243ec1c1f8ab19dff7c3a1
• https://github.com/filamentphp/filament/pull/20308
• https://github.com/filamentphp/filament/releases/tag/v4.12.5
• https://github.com/filamentphp/filament/releases/tag/v5.7.5
• https://github.com/filamentphp/filament/security/advisories/GHSA-xwpv-pqxp-5v36

Published

Sep 1, 2026

Last Modified

Sep 1, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8429SPIP versions prior to 4.4.14 contain a remote code executio…8.8
• CVE-2026-8430SPIP versions prior to 4.4.14 contain a remote code executio…9.2
• CVE-2026-84303gRPC-Go is the Go language implementation of gRPC. Prior to …6.3
• CVE-2026-84304gRPC-Go is the Go language implementation of gRPC. Prior to …8.7
• CVE-2026-84305sqlparse is a non-validating SQL parser module for Python. P…5.1
• CVE-2026-84306Filament is a collection of full-stack components for accele…6.5
• CVE-2026-84308phpseclib is a PHP secure communications library. Prior to 3…6.3
• CVE-2026-84309pypdf is a free and open-source pure-python PDF library. Pri…6.9
• CVE-2026-8431An administrative user with access to configure webhooks can…9.4
• CVE-2026-8432Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Requ…8.8
• CVE-2026-8433Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Requ…8.8
• CVE-2026-8434Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Requ…8.8