CVE-2026-77567 Filament: App-based MFA can be bypassed when recovery codes are enabled
Attackers can bypass app-based multi-factor authentication in Filament when recovery codes are enabled due to incorrect form handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77567?
CVE-2026-77567 is a high-severity authentication bypass vulnerability in filamentphp filament, published on 24 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor authentication is not affected. This issue is fixed in versions 4.12.0 and 5.7.0.
Weakness: CWE-287
Which versions are affected by CVE-2026-77567?
4 open source packages ship an affected version, including filament/filament.
| Package | Affected | Fixed in |
|---|---|---|
filament/filament Packagist | From 4.0.0 | 4.12.0 |
filament/filament Packagist | From 4.0.0 | 4.12.0 |
filament/filament Packagist | From 5.0.0 | 5.7.0 |
filament/filament Packagist | From 5.0.0 | 5.7.0 |
How do I fix CVE-2026-77567?
Upgrade filament/filament to a fixed version for your release line: 4.12.0 or 5.7.0.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-77567 being exploited?
There is no known exploitation of CVE-2026-77567 in the wild and no public exploit code.
Sources
Also known as GHSA-52xp-w8hr-xv3c.