{"uuid": "ee1f8282-21ef-4849-a432-5a9438b41d78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-104181", "type": "seen", "source": "https://gist.github.com/alon710/b05db99c50e1d9c27a03cd068857f7b3", "content": "# CVE-2026-104181: CVE-2026-104181: Authentication Bypass and Privilege Escalation in Filament Multi-Factor Authentication\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-10-05\n> **Full Report:** https://cvereports.com/reports/CVE-2026-104181\n\n## Summary\nAn authentication bypass and privilege escalation vulnerability exists in Filament (filamentphp/filament) due to missing password verification during multi-factor authentication (MFA) setup and management. An attacker with access to an active session can modify or disable MFA, leading to account hijacking.\n\n## TL;DR\nFilament failed to prompt for the user's password when modifying, disabling, or establishing app-based multi-factor authentication (MFA). If an attacker hijacked an active session, they could bind their own MFA token or disable the user's protection without knowing the master password.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-306\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.4\n- **EPSS Score**: 0.0034\n- **Impact**: Account Takeover / Multi-Factor Authentication Bypass\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Filament Panel Builder application instances using app-based multi-factor authentication (TOTP).\n- **Filament**: >= 4.0.0, < 4.13.3 (Fixed in: `4.13.3`)\n- **Filament**: >= 5.0.0, < 5.8.3 (Fixed in: `5.8.3`)\n\n## Mitigation\n\n- Upgrade Filament dependencies to version 4.13.3 or higher (for v4 installations) or 5.8.3 or higher (for v5 installations).\n- Enforce session timeout policies to minimize the window of opportunity for session hijacking.\n- Implement robust Content Security Policies (CSP) to mitigate Cross-Site Scripting (XSS) risks that could lead to session access.\n\n**Remediation Steps:**\n1. Open the project's composer.json file.\n2. Update the 'filament/filament' dependency line to reference '^4.13.3' or '^5.8.3' depending on the major version in use.\n3. Run the command: composer update filament/filament\n4. Verify the installed version in composer.lock to ensure the patched release is active.\n5. Clear application and route caches using: php artisan config:clear && php artisan cache:clear\n\n## References\n\n- [GHSA-7m6h-rg42-m449 Advisory on GitHub](https://github.com/filamentphp/filament/security/advisories/GHSA-7m6h-rg42-m449)\n- [NVD CVE-2026-104181 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-104181)\n- [Fix Commit](https://github.com/filamentphp/filament/commit/6d4dae6d7a94ce5aefd7ed4dc836acb0e6b71bb1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-104181) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T12:30:32.000000Z"}