CVE-2026-84306 - Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used
Brief
CVE ID : CVE-2026-84306
Published : Sept. 1, 2026, 7:10 p. m.
- 6 minutes ago
Description : Filament is a collection of full-stack components for accelerated Laravel development. From 4.
- 0 until 4.
- 6 and 5.
- 6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication. php uses AppAuthentication::verifyCode() with a used-code cache key derived from both the app authentication secret and the submitted TOTP code.
This isolates the newest accepted timestep by code instead of by secret, allowing a previously issued app-based MFA code to be accepted after a newer code has already been used. Reuse of the exact same code was already prevented, but another code inside the accepted time window remained usable.