DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-84306: CVE-2026-84306: Multi-Factor Authentication Bypass via Replay Attack in Filament

#security #cve #cybersecurity

CVE-2026-84306: Multi-Factor Authentication Bypass via Replay Attack in Filament

Vulnerability ID: CVE-2026-84306
CVSS Score: 6.5
Published: 2026-09-01

A multi-factor authentication bypass vulnerability exists in Filament (Laravel full-stack framework panels) due to improper time-step tracking of Time-Based One-Time Password (TOTP) codes. By submitting valid TOTP codes from an older time window within the drift allowance, an attacker with a user's password can bypass the single-use MFA guarantee and obtain unauthorized account access.

TL;DR

Filament's TOTP verification allowed the replay of older valid codes within the drift window because it tracked used codes individually rather than globally tracking the last accepted timestep. This allowed an attacker with compromised passwords to bypass multi-factor authentication.

Technical Details

  • CWE ID: CWE-294
  • Attack Vector: Network
  • CVSS v3.1 Score: 6.5
  • Exploit Status: None/Unproven
  • CISA KEV Status: Not Listed
  • Vulnerability Type: Authentication Bypass by Capture-replay

Affected Systems

  • Filament Framework Panels
  • Filament: >= 4.0.0, < 4.12.6 (Fixed in: 4.12.6)
  • Filament: >= 5.0.0, < 5.7.6 (Fixed in: 5.7.6)

Code Analysis

Commit: b6bde85

Fix MFA replay/bypass vulnerability by tracking the timestep globally per secret instead of per code, and introduce concurrent execution locking.

Mitigation Strategies

  • Upgrade Filament to version 4.12.6 or 5.7.6
  • Configure a lock-supporting cache driver such as Redis or Memcached in production to ensure concurrency locking.
  • Reduce the clock drift window to the minimum acceptable value to narrow the reuse window.

Remediation Steps:

  1. 1. Identify the current version of Filament used in your project by inspecting your composer.json file.
  2. 2. Execute 'composer update filament/filament:^4.12.6' or 'composer update filament/filament:^5.7.6' to install the secure release.
  3. 3. Ensure that your CACHE_DRIVER in your .env file is set to 'redis', 'memcached', or another store that implements LockProvider.
  4. 4. Run 'php artisan cache:clear' to clean legacy cache entries.
  5. 5. Monitor log files for any unauthorized MFA logins or lock-related failures.

References

Read the full report for CVE-2026-84306 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)