{"metadata": {"vulnerability": "cve-2026-48166", "count": 14, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-05-20T23:12:43.032Z", "date_only": false, "value": "2026-05-20T23:12:43.032Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-48166", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-06-22T21:40:01.897Z", "date_only": false, "value": "2026-06-22T21:40:01.897Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-48166", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-06-22T21:42:37.340Z", "date_only": false, "value": "2026-06-22T21:42:37.340Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2026-48166", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-22T22:16:46Z", "date_only": false, "value": "2026-06-22T22:16:46Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-5W46-G9PQ-WH6F", "record": "GHSA-5W46-G9PQ-WH6F", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-06-22T22:16:46.750Z", "date_only": false, "value": "2026-06-22T22:16:46.750", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-48166", "record": "FKIE_CVE-2026-48166", "field": "published"}, {"timestamp": "2026-06-23T00:28:10.488Z", "date_only": false, "value": "2026-06-23T00:28:10.488985Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mow5eqds6w2q", "record": "CVE-2026-48166", "field": "creation_timestamp", "uuid": "b7792bcc-51b9-4c31-b429-a228ce0cc745", "content": "CVE-2026-48166 - Filament: Timing-based user enumeration on login page\nCVE ID : CVE-2026-48166\n \n Published : June 22, 2026, 9:40 p.m. | 2\u00a0hours, 4\u00a0minutes ago\n \n Description : Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 un...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3mow5eqds6w2q"}, {"timestamp": "2026-06-23T12:28:19.870Z", "date_only": false, "value": "2026-06-23T12:28:19.870932Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-48166", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-06-23T12:28:19.870Z", "date_only": false, "value": "2026-06-23T12:28:19.870932Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-48166", "record": "FKIE_CVE-2026-48166", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-06-23T12:29:33.902Z", "date_only": false, "value": "2026-06-23T12:29:33.902Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-48166", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-06-23T12:29:33.902Z", "date_only": false, "value": "2026-06-23T12:29:33.902Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-48166", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-23T15:03:56.637Z", "date_only": false, "value": "2026-06-23T15:03:56.637", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-48166", "record": "FKIE_CVE-2026-48166", "field": "lastModified"}, {"timestamp": "2026-06-23T21:54:35Z", "date_only": false, "value": "2026-06-23T21:54:35Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-5W46-G9PQ-WH6F", "record": "GHSA-5W46-G9PQ-WH6F", "field": "published"}, {"timestamp": "2026-06-23T21:54:35Z", "date_only": false, "value": "2026-06-23T21:54:35Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-5W46-G9PQ-WH6F", "record": "GHSA-5W46-G9PQ-WH6F", "field": "modified"}, {"timestamp": "2026-06-24T07:42:24Z", "date_only": false, "value": "2026-06-24T07:42:24.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/0cc6180222e375f03b77f1081a3811f5", "record": "CVE-2026-48166", "field": "creation_timestamp", "uuid": "7686756a-f0ae-44e1-80c2-4e1c9aefdece", "content": "# CVE-2026-48166: CVE-2026-48166: Timing-Based User Enumeration on Login Page in Filament\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-06-23\n> **Full Report:** https://cvereports.com/reports/CVE-2026-48166\n\n## Summary\nAn observable timing discrepancy vulnerability (CWE-208) in Filament's administrative login page allows unauthenticated remote attackers to determine the existence of registered email addresses. This timing side-channel arises from short-circuiting logic that skips expensive password hashing checks when a queried email address is not found in the database. Attackers can execute statistical timing attacks to map active administrator accounts, facilitating subsequent targeted brute-force or credential-stuffing campaigns.\n\n## TL;DR\nA timing-based user enumeration vulnerability in Filament login pages allows unauthenticated remote attackers to identify valid registered email addresses due to a short-circuiting logic flaw in the authentication mechanism.\n\n## Technical Details\n\n- **CWE ID**: CWE-208\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 5.3 (Medium)\n- **EPSS Score**: 0.0021\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- filament/filament\n- Filament Panels\n- Filament Auth Page\n- **filament/filament**: >= 4.0.0, < 4.11.5 (Fixed in: `4.11.5`)\n- **filament/filament**: >= 5.0.0, < 5.6.5 (Fixed in: `5.6.5`)\n\n## Mitigation\n\n- Upgrade filament/filament package to 4.11.5 (for v4.x) or 5.6.5 (for v5.x).\n- Increase the timebox_duration configuration in auth.php to exceed peak CPU hashing latencies.\n- Deploy web application rate limiting on the login route to block automated sequential timing tests.\n\n**Remediation Steps:**\n1. Verify the current Filament version via 'composer show filament/filament'.\n2. Run 'composer update filament/filament' to apply the official security patch.\n3. Review 'config/auth.php' and adjust the 'timebox_duration' config variable based on production hardware constraints.\n4. Implement rate limit configurations at the web server (Nginx/Apache) or reverse proxy layer for the administrative login URI.\n\n## References\n\n- [GHSA-5w46-g9pq-wh6f: Timing-Based User Enumeration on Login Page in Filament](https://github.com/filamentphp/filament/security/advisories/GHSA-5w46-g9pq-wh6f)\n- [Fix Commit 33a9f576efb0d43372607487aebd17eae4315f1f](https://github.com/filamentphp/filament/commit/33a9f576efb0d43372607487aebd17eae4315f1f)\n- [CVE-2026-48166 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-48166)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-48166) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/0cc6180222e375f03b77f1081a3811f5"}]}