{"vulnerability": "GHSA-52xp-w8hr-xv3c", "sightings": [{"uuid": "507c3f8e-eba6-4ce6-bbf0-cf7dde9481d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-52xp-w8hr-xv3c", "type": "seen", "source": "https://gist.github.com/alon710/82c1345fb72ef5ca8fd6cd81e5d856bc", "content": "# CVE-2026-77567: CVE-2026-77567: Multi-Factor Authentication Bypass in Filament App-Based MFA\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-77567\n\n## Summary\nAn authentication bypass vulnerability exists in Filament's app-based (TOTP/authenticator) multi-factor authentication (MFA) system when recovery codes are enabled. This allow attackers possessing primary credentials to bypass the second-factor authentication check entirely by manipulating the Livewire state during the challenge-form validation lifecycle.\n\n## TL;DR\nA high-severity authentication bypass in Filament's app-based MFA system allows an attacker with valid primary credentials to completely skip the second-factor verification step by manipulating Livewire state parameters when recovery codes are configured.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287 (Improper Authentication)\n- **Attack Vector**: Network\n- **CVSS v3.1**: 8.1\n- **EPSS Score**: 0.00304\n- **EPSS Percentile**: 22.61%\n- **Exploit Status**: PoC (Proof-of-Concept)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Filament Panel applications running version 4.x prior to 4.12.0\n- Filament Panel applications running version 5.x prior to 5.7.0\n- **Filament**: >= 4.0.0, < 4.12.0 (Fixed in: `4.12.0`)\n- **Filament**: >= 5.0.0, < 5.7.0 (Fixed in: `5.7.0`)\n\n## Mitigation\n\n- Upgrade Filament dependencies to version 4.12.0+ or 5.7.0+ immediately.\n- Disable recovery codes globally to prevent reaching the vulnerable logical state path.\n- Transition MFA configurations to email-based multi-factor verification as a temporary mitigation.\n\n**Remediation Steps:**\n1. Identify the current major version of Filament used in your composer.json file.\n2. Run 'composer update filament/filament:\"^4.12.0\"' or 'composer update filament/filament:\"^5.7.0\"' based on the active branch.\n3. Clear application and view caches using 'php artisan view:clear' and 'php artisan cache:clear'.\n4. Verify that the updated packages are properly loaded by testing authentication in a staging environment.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/filamentphp/filament/security/advisories/GHSA-52xp-w8hr-xv3c)\n- [Fix Patch Commit](https://github.com/filamentphp/filament/commit/45534a6f87f50ac6df3b43680bb33f8da9ef207b)\n- [Filament Release Tag v4.12.0](https://github.com/filamentphp/filament/releases/tag/v4.12.0)\n- [Filament Release Tag v5.7.0](https://github.com/filamentphp/filament/releases/tag/v5.7.0)\n- [National Vulnerability Database Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-77567)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-77567) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T02:32:21.871299Z"}]}