CVE-2026-84306 filamentphp CVE debrief

Who should care

Laravel Filament users who have multi-factor authentication enabled should assess their exposure and upgrade to a fixed version. This includes operators, administrators, and security teams responsible for maintaining Filament deployments. Affected users must verify their current version, assess potential exposure, and apply necessary updates or mitigations.

Why it matters

CVE-2026-84306 is a medium-severity vulnerability in Laravel Filament's multi-factor authentication system. Users of affected versions should upgrade to 4.12.6 or 5.7.6 to prevent potential MFA code reuse by attackers. Defenders should verify their current version, assess exposure, and monitor for suspicious login activity.

• An attacker can reuse a valid app-based MFA code for approximately four minutes after it has been used by the legitimate account holder
• The attacker must have obtained the target account's password and at least one app-based MFA code
• Email-based MFA is not affected by this vulnerability
• Verification of affected versions and remediation efforts is required

Technical summary

The CVE-2026-84306 vulnerability affects Laravel Filament versions from 4.0.0 to 4.12.5 and 5.0.0 to 5.7.5. It allows an attacker who obtains the target account's password and one app-based MFA code to reuse that code for approximately four minutes, even after the legitimate account holder logs in with a newer code. This is due to the way Filament's AppAuthentication::verifyCode() handles used-code cache keys.

Defensive priority

Medium priority for Laravel Filament users

Recommended defensive actions

• Upgrade to Filament version 4.12.6 or 5.7.6
• Review and adjust MFA settings
• Monitor for suspicious login activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD details indicate a medium-severity vulnerability in Laravel Filament's multi-factor authentication system. An attacker with the target account's password and one app-based MFA code can reuse that code for approximately four minutes, even after the legitimate account holder logs in with a newer code.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.