{"metadata": {"vulnerability": "CVE-2026-77567", "count": 14, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-08-20T20:35:30.147Z", "date_only": false, "value": "2026-08-20T20:35:30.147Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-77567", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-24T20:10:58.326Z", "date_only": false, "value": "2026-08-24T20:10:58.326Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-77567", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-08-24T20:10:58.326Z", "date_only": false, "value": "2026-08-24T20:10:58.326Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-77567", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-24T21:17:48Z", "date_only": false, "value": "2026-08-24T21:17:48Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-52XP-W8HR-XV3C", "record": "GHSA-52XP-W8HR-XV3C", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-08-24T21:17:48.150Z", "date_only": false, "value": "2026-08-24T21:17:48.150", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77567", "record": "FKIE_CVE-2026-77567", "field": "published"}, {"timestamp": "2026-08-24T22:00:30.274Z", "date_only": false, "value": "2026-08-24T22:00:30.274594Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtucinw3f72o", "record": "CVE-2026-77567", "field": "creation_timestamp", "uuid": "1d57eb46-c27f-4668-82e0-460a722e368e", "content": "\ud83d\udfe0 CVE-2026-77567 - High (8.1)\n\nFilament is a collection of full-stack components for accelerated Laravel development. Prior to v...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-77567/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtucinw3f72o"}, {"timestamp": "2026-08-27T14:17:17.322Z", "date_only": false, "value": "2026-08-27T14:17:17.322684Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-77567", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-27T14:17:17.322Z", "date_only": false, "value": "2026-08-27T14:17:17.322684Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77567", "record": "FKIE_CVE-2026-77567", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-08-27T14:17:29.291Z", "date_only": false, "value": "2026-08-27T14:17:29.291Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-77567", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-27T14:17:29.291Z", "date_only": false, "value": "2026-08-27T14:17:29.291Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-77567", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-01T21:28:47Z", "date_only": false, "value": "2026-09-01T21:28:47Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-52XP-W8HR-XV3C", "record": "GHSA-52XP-W8HR-XV3C", "field": "published"}, {"timestamp": "2026-09-01T21:28:47Z", "date_only": false, "value": "2026-09-01T21:28:47Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-52XP-W8HR-XV3C", "record": "GHSA-52XP-W8HR-XV3C", "field": "modified"}, {"timestamp": "2026-09-02T02:32:21.817Z", "date_only": false, "value": "2026-09-02T02:32:21.817721Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/82c1345fb72ef5ca8fd6cd81e5d856bc", "record": "CVE-2026-77567", "field": "creation_timestamp", "uuid": "09527575-eae5-4149-960b-ecd87d501efc", "content": "# CVE-2026-77567: CVE-2026-77567: Multi-Factor Authentication Bypass in Filament App-Based MFA\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-77567\n\n## Summary\nAn authentication bypass vulnerability exists in Filament's app-based (TOTP/authenticator) multi-factor authentication (MFA) system when recovery codes are enabled. This allow attackers possessing primary credentials to bypass the second-factor authentication check entirely by manipulating the Livewire state during the challenge-form validation lifecycle.\n\n## TL;DR\nA high-severity authentication bypass in Filament's app-based MFA system allows an attacker with valid primary credentials to completely skip the second-factor verification step by manipulating Livewire state parameters when recovery codes are configured.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287 (Improper Authentication)\n- **Attack Vector**: Network\n- **CVSS v3.1**: 8.1\n- **EPSS Score**: 0.00304\n- **EPSS Percentile**: 22.61%\n- **Exploit Status**: PoC (Proof-of-Concept)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Filament Panel applications running version 4.x prior to 4.12.0\n- Filament Panel applications running version 5.x prior to 5.7.0\n- **Filament**: >= 4.0.0, < 4.12.0 (Fixed in: `4.12.0`)\n- **Filament**: >= 5.0.0, < 5.7.0 (Fixed in: `5.7.0`)\n\n## Mitigation\n\n- Upgrade Filament dependencies to version 4.12.0+ or 5.7.0+ immediately.\n- Disable recovery codes globally to prevent reaching the vulnerable logical state path.\n- Transition MFA configurations to email-based multi-factor verification as a temporary mitigation.\n\n**Remediation Steps:**\n1. Identify the current major version of Filament used in your composer.json file.\n2. Run 'composer update filament/filament:\"^4.12.0\"' or 'composer update filament/filament:\"^5.7.0\"' based on the active branch.\n3. Clear application and view caches using 'php artisan view:clear' and 'php artisan cache:clear'.\n4. Verify that the updated packages are properly loaded by testing authentication in a staging environment.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/filamentphp/filament/security/advisories/GHSA-52xp-w8hr-xv3c)\n- [Fix Patch Commit](https://github.com/filamentphp/filament/commit/45534a6f87f50ac6df3b43680bb33f8da9ef207b)\n- [Filament Release Tag v4.12.0](https://github.com/filamentphp/filament/releases/tag/v4.12.0)\n- [Filament Release Tag v5.7.0](https://github.com/filamentphp/filament/releases/tag/v5.7.0)\n- [National Vulnerability Database Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-77567)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-77567) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/82c1345fb72ef5ca8fd6cd81e5d856bc"}, {"timestamp": "2026-10-12T15:10:00.207Z", "date_only": false, "value": "2026-10-12T15:10:00.207", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77567", "record": "FKIE_CVE-2026-77567", "field": "lastModified"}]}