CVE-2026-84307: CVE-2026-84307: Authentication Oracle and Multi-Factor Authentication Challenge Leak in Filament

#security #cve #cybersecurity

CVE-2026-84307: Authentication Oracle and Multi-Factor Authentication Challenge Leak in Filament

Vulnerability ID: CVE-2026-84307
CVSS Score: 3.7
Published: 2026-09-01

An authentication oracle vulnerability exists in Filament before 4.12.5 and 5.7.5. The application initiates MFA challenge workflows prior to verifying user authorization policies, allowing unauthenticated attackers to validate guessed credentials.

TL;DR

Filament leaked credential validity by triggering MFA flows before verifying user authorization checks.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-204
Attack Vector: Network
CVSS v3.1 Score: 3.7 (Low)
EPSS Score: Not Available
Impact: Credential Enumeration / Information Disclosure
Exploit Status: Proof of Concept
KEV Status: Not Listed

Affected Systems

filamentphp/filament
Filament: >= 4.0.0, < 4.12.5 (Fixed in: 4.12.5)
Filament: >= 5.0.0, < 5.7.5 (Fixed in: 5.7.5)

Code Analysis

Commit: ad5aacb

Fix authentication oracle by verifying panel access prior to MFA triggers

Mitigation Strategies

Upgrade Filament to version 4.12.5 or 5.7.5
Implement strict rate limiting on the login endpoints
Monitor outbound MFA email notifications for anomalous surges

Remediation Steps:

Run 'composer update filament/filament' to retrieve the latest secure package versions.
Verify the installed version in composer.lock is at least 4.12.5 or 5.7.5.
Deploy the updated application to production environments.

References

Read the full report for CVE-2026-84307 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community