DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-77567: CVE-2026-77567: Multi-Factor Authentication Bypass in Filament App-Based MFA

#security #cve #cybersecurity

CVE-2026-77567: Multi-Factor Authentication Bypass in Filament App-Based MFA

Vulnerability ID: CVE-2026-77567
CVSS Score: 8.1
Published: 2026-09-01

An authentication bypass vulnerability exists in Filament's app-based (TOTP/authenticator) multi-factor authentication (MFA) system when recovery codes are enabled. This allow attackers possessing primary credentials to bypass the second-factor authentication check entirely by manipulating the Livewire state during the challenge-form validation lifecycle.

TL;DR

A high-severity authentication bypass in Filament's app-based MFA system allows an attacker with valid primary credentials to completely skip the second-factor verification step by manipulating Livewire state parameters when recovery codes are configured.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-287 (Improper Authentication)
  • Attack Vector: Network
  • CVSS v3.1: 8.1
  • EPSS Score: 0.00304
  • EPSS Percentile: 22.61%
  • Exploit Status: PoC (Proof-of-Concept)
  • KEV Status: Not Listed

Affected Systems

  • Filament Panel applications running version 4.x prior to 4.12.0
  • Filament Panel applications running version 5.x prior to 5.7.0
  • Filament: >= 4.0.0, < 4.12.0 (Fixed in: 4.12.0)
  • Filament: >= 5.0.0, < 5.7.0 (Fixed in: 5.7.0)

Code Analysis

Commit: 45534a6

Fix app multi-factor authentication bypass vulnerability when recovery codes are enabled.

Exploit Details

  • Filament Security Advisory: Exploit concepts are reproducible via official test suites and code-level verification in the Filament framework repository.

Mitigation Strategies

  • Upgrade Filament dependencies to version 4.12.0+ or 5.7.0+ immediately.
  • Disable recovery codes globally to prevent reaching the vulnerable logical state path.
  • Transition MFA configurations to email-based multi-factor verification as a temporary mitigation.

Remediation Steps:

  1. Identify the current major version of Filament used in your composer.json file.
  2. Run 'composer update filament/filament:"^4.12.0"' or 'composer update filament/filament:"^5.7.0"' based on the active branch.
  3. Clear application and view caches using 'php artisan view:clear' and 'php artisan cache:clear'.
  4. Verify that the updated packages are properly loaded by testing authentication in a staging environment.

References

Read the full report for CVE-2026-77567 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)