GHSA-r3j6-gpjw-qfjr: Medium severity composer/filament/filament vulnerability
A flaw in the handling of one-time codes for app-based multi-factor authentication allows a previously issued code to be used after a newer code has already been accepted. This issue does not affect email-based MFA. Submitting the exact same code twice was already prevented, but any other code within the accepted time window was not.
If an attacker gains access to both the user's password and a single one-time code, that code stays usable for the remainder of its time window, which is around four minutes on the default settings, including after the legitimate user has already logged in with a newer code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/filament/filamentto a version that resolves this vulnerability.Fixed in 5.7.6 - Upgrade
Upgrade
composer/filament/filamentto a version that resolves this vulnerability.Fixed in 4.12.6
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users authenticated with app-based multi-factor authentication are affected. Email-based MFA is not affected.
What does an attacker need to exploit it?
An attacker needs both the user's password and a one-time code issued within the currently accepted time window. A code other than one already submitted can remain usable after the legitimate user logs in with a newer code.
Are default settings affected, and how long can a captured code remain usable?
Yes. Under the default settings, the accepted time window is around four minutes, during which a previously issued app-based MFA code may remain usable.