https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 20:05:38 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-329246 EUVD-2026-329246 https://cve.radiocsirt.org/vuln/euvd-2026-329246 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48505 <p>Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, a flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. If an attacker gains access to both the user&#39;s password and their recovery codes, they get two authenticated sessions per recovery code burned instead of one, or more if they batch the parallel submissions wider, materially extending the attacker&#39;s window of access compared to what the single-use guarantee implies. This vulnerability is fixed in 4.11.5 and 5.6.5.</p> <p>Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, a flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused via concurrent submission. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. If an attacker gains access to both the user&#39;s password and their recovery codes, they get two authenticated sessions per recovery code burned instead of one, or more if they batch the parallel submissions wider, materially extending the attacker&#39;s window of access compared to what the single-use guarantee implies. This vulnerability is fixed in 4.11.5 and 5.6.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48505 https://cve.radiocsirt.org/vuln/ghsa-mc5j-f6wx-h9qh <p><strong>Affected:</strong> Packagist: filament/filament</p> <p>A flaw in the handling of recovery codes for **app-based multi-factor authentication** allows the same recovery code to be reused via concurrent submission. This issue does **not** affect email-based MFA. It also only applies when recovery codes are enabled.</p> <p>If an attacker gains access to both the user&#39;s password and their recovery codes, they get two authenticated sessions per recovery code burned instead of one, or more if they batch the parallel submissions wider, materially extending the attacker&#39;s window of access compared to what the single-use guarantee implies.</p> <p><strong>Affected:</strong> Packagist: filament/filament</p> <p>A flaw in the handling of recovery codes for **app-based multi-factor authentication** allows the same recovery code to be reused via concurrent submission. This issue does **not** affect email-based MFA. It also only applies when recovery codes are enabled.</p> <p>If an attacker gains access to both the user&#39;s password and their recovery codes, they get two authenticated sessions per recovery code burned instead of one, or more if they batch the parallel submissions wider, materially extending the attacker&#39;s window of access compared to what the single-use guarantee implies.</p> https://cve.radiocsirt.org/vuln/ghsa-mc5j-f6wx-h9qh