What is GHSA-5w46-g9pq-wh6f?

GHSA-5w46-g9pq-wh6f is a security advisory published by GitHub Security Advisories with Medium severity. Filament: Timing-based user enumeration on login page

Which CVE IDs does GHSA-5w46-g9pq-wh6f cover?

GHSA-5w46-g9pq-wh6f covers the following CVE IDs: CVE-2026-48166. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5w46-g9pq-wh6f?

GHSA-5w46-g9pq-wh6f has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-5w46-g9pq-wh6f?

GHSA-5w46-g9pq-wh6f affects 2 products, including: composer/filament/filament:\u003e= 4.0.0, \u003c= 4.11.4; composer/filament/filament:\u003e= 5.0.0, \u003c= 5.6.4.

GHSA-5w46-g9pq-wh6fMediumCVSS 5.3

Filament: Timing-based user enumeration on login page

Vendor

GitHub Security Advisories

Published

June 23, 2026

Last Modified

June 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-48166 →

📋 Description

The login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email addresses. The impact is limited to disclosing whether an account exists for a given email.

🎯 Affected products2

composer/filament/filament:>= 4.0.0, <= 4.11.4
composer/filament/filament:>= 5.0.0, <= 5.6.4

🔗 References (3)

https://github.com/filamentphp/filament/security/advisories/GHSA-5w46-g9pq-wh6f
https://nvd.nist.gov/vuln/detail/CVE-2026-48166
https://github.com/advisories/GHSA-5w46-g9pq-wh6f