{"action":"Upgrade filament/filament to 4.12.0 or later.","affected":[{"fixed":"4.12.0","introduced":"4.0.0"},{"fixed":"5.7.0","introduced":"5.0.0"}],"component":"filament/filament","cve_ids":["CVE-2026-77567"],"ecosystem":"Packagist","epss":0.00551,"exploited":false,"fixed_versions":["4.12.0","5.7.0"],"ghsa_id":"GHSA-52xp-w8hr-xv3c","id":"tcs_01M5KEVH604VNAJB0Q7AJMAP4D","modified_at":"2026-09-01T21:30:06.792743426Z","published_at":"2026-09-01T21:28:47Z","references":["https://osv.dev/vulnerability/GHSA-52xp-w8hr-xv3c","https://github.com/filamentphp/filament/security/advisories/GHSA-52xp-w8hr-xv3c","https://nvd.nist.gov/vuln/detail/CVE-2026-77567","https://github.com/filamentphp/filament/commit/45534a6f87f50ac6df3b43680bb33f8da9ef207b","https://github.com/filamentphp/filament","https://github.com/filamentphp/filament/releases/tag/v4.12.0","https://github.com/filamentphp/filament/releases/tag/v5.7.0"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-52xp-w8hr-xv3c","url":"https://osv.dev/vulnerability/GHSA-52xp-w8hr-xv3c"}],"summary":"Filament: Multi-factor authentication (app) can be bypassed when recovery codes are enabled"}