https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 11 Sep 2026 21:54:15 +0000 https://vulnerability.circl.lu/sighting/eae8aab1-ba7e-4899-8f81-6bd393df7042/export {"uuid": "eae8aab1-ba7e-4899-8f81-6bd393df7042", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84306", "type": "seen", "source": "https://gist.github.com/alon710/f0327fbec515b265e501091e4bb41d35", "content": "# CVE-2026-84306: CVE-2026-84306: Multi-Factor Authentication Bypass via Replay Attack in Filament\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84306\n\n## Summary\nA multi-factor authentication bypass vulnerability exists in Filament (Laravel full-stack framework panels) due to improper time-step tracking of Time-Based One-Time Password (TOTP) codes. By submitting valid TOTP codes from an older time window within the drift allowance, an attacker with a user's password can bypass the single-use MFA guarantee and obtain unauthorized account access.\n\n## TL;DR\nFilament's TOTP verification allowed the replay of older valid codes within the drift window because it tracked used codes individually rather than globally tracking the last accepted timestep. This allowed an attacker with compromised passwords to bypass multi-factor authentication.\n\n## Technical Details\n\n- **CWE ID**: CWE-294\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.5\n- **Exploit Status**: None/Unproven\n- **CISA KEV Status**: Not Listed\n- **Vulnerability Type**: Authentication Bypass by Capture-replay\n\n## Affected Systems\n\n- Filament Framework Panels\n- **Filament**: >= 4.0.0, < 4.12.6 (Fixed in: `4.12.6`)\n- **Filament**: >= 5.0.0, < 5.7.6 (Fixed in: `5.7.6`)\n\n## Mitigation\n\n- Upgrade Filament to version 4.12.6 or 5.7.6\n- Configure a lock-supporting cache driver such as Redis or Memcached in production to ensure concurrency locking.\n- Reduce the clock drift window to the minimum acceptable value to narrow the reuse window.\n\n**Remediation Steps:**\n1. 1. Identify the current version of Filament used in your project by inspecting your composer.json file.\n2. 2. Execute 'composer update filament/filament:^4.12.6' or 'composer update filament/filament:^5.7.6' to install the secure release.\n3. 3. Ensure that your CACHE_DRIVER in your .env file is set to 'redis', 'memcached', or another store that implements LockProvider.\n4. 4. Run 'php artisan cache:clear' to clean legacy cache entries.\n5. 5. Monitor log files for any unauthorized MFA logins or lock-related failures.\n\n## References\n\n- [GitHub Security Advisory GHSA-r3j6-gpjw-qfjr](https://github.com/filamentphp/filament/security/advisories/GHSA-r3j6-gpjw-qfjr)\n- [CVE-2026-84306 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-84306)\n- [Official Patch Commit](https://github.com/filamentphp/filament/commit/b6bde8572bcac75d4f5b4ec892ba7b9e91e0ab4d)\n- [Official Pull Request](https://github.com/filamentphp/filament/pull/20335)\n- [Filament v4.12.6 Release Notes](https://github.com/filamentphp/filament/releases/tag/v4.12.6)\n- [Filament v5.7.6 Release Notes](https://github.com/filamentphp/filament/releases/tag/v5.7.6)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84306) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T00:32:16.866612Z"} {"uuid": "eae8aab1-ba7e-4899-8f81-6bd393df7042", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84306", "type": "seen", "source": "https://gist.github.com/alon710/f0327fbec515b265e501091e4bb41d35", "content": "# CVE-2026-84306: CVE-2026-84306: Multi-Factor Authentication Bypass via Replay Attack in Filament\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84306\n\n## Summary\nA multi-factor authentication bypass vulnerability exists in Filament (Laravel full-stack framework panels) due to improper time-step tracking of Time-Based One-Time Password (TOTP) codes. By submitting valid TOTP codes from an older time window within the drift allowance, an attacker with a user's password can bypass the single-use MFA guarantee and obtain unauthorized account access.\n\n## TL;DR\nFilament's TOTP verification allowed the replay of older valid codes within the drift window because it tracked used codes individually rather than globally tracking the last accepted timestep. This allowed an attacker with compromised passwords to bypass multi-factor authentication.\n\n## Technical Details\n\n- **CWE ID**: CWE-294\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.5\n- **Exploit Status**: None/Unproven\n- **CISA KEV Status**: Not Listed\n- **Vulnerability Type**: Authentication Bypass by Capture-replay\n\n## Affected Systems\n\n- Filament Framework Panels\n- **Filament**: >= 4.0.0, < 4.12.6 (Fixed in: `4.12.6`)\n- **Filament**: >= 5.0.0, < 5.7.6 (Fixed in: `5.7.6`)\n\n## Mitigation\n\n- Upgrade Filament to version 4.12.6 or 5.7.6\n- Configure a lock-supporting cache driver such as Redis or Memcached in production to ensure concurrency locking.\n- Reduce the clock drift window to the minimum acceptable value to narrow the reuse window.\n\n**Remediation Steps:**\n1. 1. Identify the current version of Filament used in your project by inspecting your composer.json file.\n2. 2. Execute 'composer update filament/filament:^4.12.6' or 'composer update filament/filament:^5.7.6' to install the secure release.\n3. 3. Ensure that your CACHE_DRIVER in your .env file is set to 'redis', 'memcached', or another store that implements LockProvider.\n4. 4. Run 'php artisan cache:clear' to clean legacy cache entries.\n5. 5. Monitor log files for any unauthorized MFA logins or lock-related failures.\n\n## References\n\n- [GitHub Security Advisory GHSA-r3j6-gpjw-qfjr](https://github.com/filamentphp/filament/security/advisories/GHSA-r3j6-gpjw-qfjr)\n- [CVE-2026-84306 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-84306)\n- [Official Patch Commit](https://github.com/filamentphp/filament/commit/b6bde8572bcac75d4f5b4ec892ba7b9e91e0ab4d)\n- [Official Pull Request](https://github.com/filamentphp/filament/pull/20335)\n- [Filament v4.12.6 Release Notes](https://github.com/filamentphp/filament/releases/tag/v4.12.6)\n- [Filament v5.7.6 Release Notes](https://github.com/filamentphp/filament/releases/tag/v5.7.6)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84306) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T00:32:16.866612Z"} https://vulnerability.circl.lu/sighting/eae8aab1-ba7e-4899-8f81-6bd393df7042/export Wed, 02 Sep 2026 00:32:16 +0000