High · published December 10, 2025
⚡ A flaw in Filament’s multi-factor authentication lets recovery codes be reused indefinitely! Think of it as having a spare key that never gets replaced, no matter how many times it’s used. 🔑 Imagine a hotel where you can keep using the same room key over and over, even after it’s been given to multiple guests. This oversight allows anyone who gets their hands on that key to walk right into your room any time they want! An attacker could exploit this to gain access to user accounts simply by using a stolen recovery code. In environments where recovery codes enable quick access, this could lead to unauthorized access and sensitive data exposure, making it a serious threat!
Imagine a hotel where you can keep using the same room key over and over, even after it’s been given to multiple guests. This oversight allows anyone who gets their hands on that key to walk right into your room any time they want! The vulnerability in Filament (versions 4.0.0 to 4.3.0) allows attackers to reuse the same recovery code for app-based multi-factor authentication, bypassing intended security measures. This issue does not affect email-based MFA.
An attacker could exploit this to gain access to user accounts simply by using a stolen recovery code. In environments where recovery codes enable quick access, this could lead to unauthorized access and sensitive data exposure, making it a serious threat! Upgrade your Filament to version 4.3.1 immediately to patch this vulnerability. Ensure that multi-factor authentication is properly configured and audit recovery code usage to enhance security. You've got this! Follow these steps and your application will be fortified in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| filamentphp/filament | ≥ 4.0.0, < 4.3.1 | 4.3.1 |