CVE-2025-67507: high-severity vulnerability in filamentphp filament
Filament's multi-factor authentication (app) recovery codes can be used multiple times
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 0.4%
Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.3.0 contain a flaw in the handling of recovery codes for app-based multi-factor authentication, allowing the same recovery code to be reused indefinitely. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. This issue is fixed in version 4.3.1.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
filamentphp · filamentRelated CVEs — filamentphp filament
In the same product, most dangerous first.
CVE-2024-51758LOWExported files stored in default (`public`) filesystem if not reconfigured in filamentEPSS 0.6%CVE-2026-77567HIGHFilament: App-based MFA can be bypassed when recovery codes are enabledEPSS 0.6%CVE-2026-84307LOWFilament: Password validity disclosure for accounts denied panel access on login pageEPSS 0.5%CVE-2026-84306MEDIUMFilament: Multi-factor authentication (app) codes can still be used after a newer code has been usedEPSS 0.4%CVE-2024-47186MEDIUMFilament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site ScriptingEPSS 0.4%CVE-2026-55409HIGHFilament: Disabled RichEditor field state can be used for XSSEPSS 0.4%