CVE-2026-48166 Filament: Timing-based user enumeration on login page
Unauthenticated attackers can enumerate registered email addresses via timing discrepancies on the login page of Filament applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48166?
CVE-2026-48166 is a medium-severity vulnerability in filamentphp filament, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, the login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email addresses. The impact is limited to disclosing whether an account exists for a given email. This vulnerability is fixed in 4.11.5 and 5.6.5.
Weakness: CWE-208
Which versions are affected by CVE-2026-48166?
4 open source packages ship an affected version, including filament/filament.
| Package | Affected | Fixed in |
|---|---|---|
filament/filament Packagist | From 4.0.0 | 4.11.5 |
filament/filament Packagist | From 4.0.0 | 4.11.5 |
filament/filament Packagist | From 5.0.0 | 5.6.5 |
filament/filament Packagist | From 5.0.0 | 5.6.5 |
How do I fix CVE-2026-48166?
Upgrade filament/filament to a fixed version for your release line: 4.11.5 or 5.6.5.
Is CVE-2026-48166 being exploited?
There is no known exploitation of CVE-2026-48166 in the wild and no public exploit code.
Sources
Also known as GHSA-5w46-g9pq-wh6f.