CVE-2026-104181: Filament: Multi-factor authentication (app) management actions do not require password reauthentication
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication management actions do not consistently require confirmation of the current password. An attacker with access to an authenticated user session can set up app-based MFA and obtain recovery codes, or disable app-based MFA and regenerate recovery codes by supplying an existing app code or recovery code, without knowing the account password. Email-based MFA is not affected, and the issue does not independently permit an unauthenticated sign-in, but changing the app-MFA configuration may lock the legitimate user out. This issue is fixed in versions 4.13.3 and 5.8.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.13.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.8.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already have access to an authenticated user session and must be able to supply an existing app-based MFA code or recovery code. The issue does not by itself allow an unauthenticated attacker to sign in.
Are all MFA methods affected?
No. The issue affects management actions for app-based MFA; email-based MFA is not affected.
What could an attacker do with a compromised authenticated session?
They could configure app-based MFA and obtain recovery codes, or disable app-based MFA and regenerate recovery codes, without knowing the account password. These changes can potentially lock the legitimate user out of the account.
Which versions contain the fix?
The issue is fixed in Filament versions 4.13.3 and 5.8.3. Affected releases are from 4.0.0 up to the fixed versions.