PT-2025-50298

CVE-2025-67507

Published

2025-12-09

Updated

2026-03-04

Description by

CVSS 3.1

8.1

High

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Filament versions 4.0.0 through 4.3.0

Description Filament, a collection of full-stack components for accelerated Laravel development, has an issue in how it manages recovery codes for application-based multi-factor authentication. The flaw allows the same recovery code to be reused repeatedly. This does not impact email-based multi-factor authentication and only occurs when recovery codes are enabled.

Recommendations Update to version 4.3.1 or later.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-287: Improper Authentication

CWE-288: Authentication Bypass Using an Alternate Path or Channel

Related identifiers

CVE-2025-67507