CVE-2026-48505 Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission
Attackers can reuse MFA recovery codes via concurrent requests, gaining multiple authenticated sessions if they possess user credentials and recovery codes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48505?
CVE-2026-48505 is a high-severity vulnerability in filamentphp filament, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, a flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. If an attacker gains access to both the user's password and their recovery codes, they get two authenticated sessions per recovery code burned instead of one, or more if they batch the parallel submissions wider, materially extending the attacker's window of access compared to what the single-use guarantee implies. This vulnerability is fixed in 4.11.5 and 5.6.5.
Which versions are affected by CVE-2026-48505?
4 open source packages ship an affected version, including filament/filament.
| Package | Affected | Fixed in |
|---|---|---|
filament/filament Packagist | From 4.0.0 | 4.11.5 |
filament/filament Packagist | From 4.0.0 | 4.11.5 |
filament/filament Packagist | From 5.0.0 | 5.6.5 |
filament/filament Packagist | From 5.0.0 | 5.6.5 |
How do I fix CVE-2026-48505?
Upgrade filament/filament to a fixed version for your release line: 4.11.5 or 5.6.5.
Is CVE-2026-48505 being exploited?
There is no known exploitation of CVE-2026-48505 in the wild and no public exploit code.
Sources
Also known as GHSA-mc5j-f6wx-h9qh.