CVE-2026-104181

Name of the Vulnerable Software and Affected Versions Filament versions 4.0.0 through 4.13.2 Filament versions 5.0.0 through 5.8.2

Description App-based multi-factor authentication (MFA) management actions do not consistently require confirmation of the current password. An attacker with access to an authenticated user session can set up app-based MFA and obtain recovery codes, or disable app-based MFA and regenerate recovery codes by supplying an existing app code or recovery code, without knowing the account password. While email-based MFA is not affected and the issue does not allow unauthenticated sign-in, modifying the app-MFA configuration may lock the legitimate user out of the account.

Recommendations Update Filament to version 4.13.3. Update Filament to version 5.8.3.