CVE-2026-48505

{
  "id": "CVE-2026-48505",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-22T22:16:47.303",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, a flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. If an attacker gains access to both the user's password and their recovery codes, they get two authenticated sessions per recovery code burned instead of one, or more if they batch the parallel submissions wider, materially extending the attacker's window of access compared to what the single-use guarantee implies. This vulnerability is fixed in 4.11.5 and 5.6.5."
    },
    {
      "lang": "es",
      "value": "Filament es una colección de componentes full-stack para el desarrollo acelerado de Laravel. Desde la 4.0.0 hasta la 4.11.5 y la 5.6.5, un fallo en el manejo de los códigos de recuperación para la autenticación multifactor basada en aplicación permite que el mismo código de recuperación sea reutilizado mediante envío concurrente. Este problema no afecta la MFA basada en correo electrónico. También solo aplica cuando los códigos de recuperación están habilitados. Si un atacante obtiene acceso tanto a la contraseña del usuario como a sus códigos de recuperación, obtiene dos sesiones autenticadas por código de recuperación quemado en lugar de una, o más si agrupa los envíos paralelos de forma más amplia, extendiendo materialmente la ventana de acceso del atacante en comparación con lo que implica la garantía de un solo uso. Esta vulnerabilidad está corregida en la 4.11.5 y la 5.6.5."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "filamentphp",
          "product": "filament",
          "versions": [
            {
              "version": ">= 4.0.0, < 4.11.5",
              "status": "affected"
            },
            {
              "version": ">= 5.0.0, < 5.6.5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-23T14:28:27.382918Z",
          "id": "CVE-2026-48505",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        },
        {
          "lang": "en",
          "value": "CWE-841"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/filamentphp/filament/security/advisories/GHSA-mc5j-f6wx-h9qh",
      "source": "[email protected]"
    }
  ]
}