What is GHSA-52xp-w8hr-xv3c?

GHSA-52xp-w8hr-xv3c is a security advisory published by GitHub Security Advisories with High severity. Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled

Which CVE IDs does GHSA-52xp-w8hr-xv3c cover?

GHSA-52xp-w8hr-xv3c covers the following CVE IDs: CVE-2026-77567. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-52xp-w8hr-xv3c?

GHSA-52xp-w8hr-xv3c has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-52xp-w8hr-xv3c?

GHSA-52xp-w8hr-xv3c affects 2 products, including: composer/filament/filament:\u003e= 4.0.0, \u003c 4.12.0; composer/filament/filament:\u003e= 5.0.0, \u003c 5.7.0.

GHSA-52xp-w8hr-xv3cHighCVSS 8.1

Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled

Vendor

GitHub Security Advisories

Published

September 1, 2026

Last Modified

September 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-77567 →

📋 Description

A flaw in the challenge handling for app-based multi-factor authentication allows the second factor to be bypassed. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled.

🎯 Affected products2

composer/filament/filament:>= 4.0.0, < 4.12.0
composer/filament/filament:>= 5.0.0, < 5.7.0

🔗 References (6)

https://github.com/filamentphp/filament/security/advisories/GHSA-52xp-w8hr-xv3c
https://nvd.nist.gov/vuln/detail/CVE-2026-77567
https://github.com/filamentphp/filament/commit/45534a6f87f50ac6df3b43680bb33f8da9ef207b
https://github.com/filamentphp/filament/releases/tag/v4.12.0
https://github.com/filamentphp/filament/releases/tag/v5.7.0
https://github.com/advisories/GHSA-52xp-w8hr-xv3c