CVE-2026-48505

Name of the Vulnerable Software and Affected Versions Filament versions 4.0.0 through 4.11.4 Filament versions prior to 5.6.5

Description A flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused via concurrent submission. This issue only applies when recovery codes are enabled and does not affect email-based multi-factor authentication. If an attacker possesses both the user's password and their recovery codes, they can obtain multiple authenticated sessions per recovery code by batching parallel submissions, extending the window of access beyond the intended single-use restriction.

Recommendations Update to version 4.11.5. Update to version 5.6.5.