VulnSocial

CVE-2026-48505General

LOWCVSS 7.4 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, a flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. If an attacker gains access to both the user's password and their recovery codes, they get two authenticated sessions per recovery code burned instead of one, or more if they batch the parallel submissions wider, materially extending the attacker's window of access compared to what the single-use guarantee implies. This vulnerability is fixed in 4.11.5 and 5.6.5.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-362CWE-841

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • General: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-06-25: 106-25
Signal classification1 categories
General
1100.0%
Referenced assets1 URL
Full discourse1 post
  • DailyCVE@dailycve
    General

    🔴 Filament (Laravel), Multi-factor Authentication Recovery Code Race Condition, #CVE-2026-48505 (High) -DC-Jun2026-643 https://dailycve.com/filament-laravel-multi-factor-authentication-recovery-code-race-condition-cve-2026-48505-high-dc-jun2026-643/

    Post summary

    The post announces a new CVE (CVE‑2026‑48505) with a link to an article, but provides no technical details, PoC, exploit code, patch information, or evidence of active exploitation.

    0000046
    216 followersView on X

Explore more

Back to dashboard