Auth bypass in Filamentphp Filament
CVE-2026-104181
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.13.3 and 5.8.3, app-based multi-factor authentication management actions do not consistently require confirmation of the current password. An attacker with access to an authenticated user session can set up app-based MFA and obtain recovery codes, or disable app-based MFA and regenerate recovery codes by supplying an existing app code or recovery code, without knowing the account password. Email-based MFA is not affected, and the issue does not independently permit an unauthenticated sign-in, but changing the app-MFA configuration may lock the legitimate user out. This issue is fixed in versions 4.13.3 and 5.8.3.
Vulnerability class: Broken Authentication
Published .
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Filamentphp Filament — versions >= 4.0.0, < 4.13.2, >= 5.0.0, < 5.8.2
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-104181?
- CVE-2026-104181 is a medium-severity vulnerability in Filamentphp Filament, classified under Missing Authentication for Critical Function. CVSS score: 5.4/10. Published 2026-10-01.
- How severe is CVE-2026-104181?
- Medium severity. CVSS v3 base score is 5.4 out of 10.