{"action":"Upgrade filament/filament to 4.12.6 or later.","affected":[{"fixed":"4.12.6","introduced":"4.0.0"},{"fixed":"5.7.6","introduced":"5.0.0"}],"component":"filament/filament","cve_ids":["CVE-2026-84306"],"ecosystem":"Packagist","epss":0.00448,"exploited":false,"fixed_versions":["4.12.6","5.7.6"],"ghsa_id":"GHSA-r3j6-gpjw-qfjr","id":"tcs_01M5KF7TR96W1T4YD463F7C8XK","modified_at":"2026-09-01T21:55:52.212308Z","published_at":"2026-09-01T21:29:43Z","references":["https://osv.dev/vulnerability/GHSA-r3j6-gpjw-qfjr","https://github.com/filamentphp/filament/security/advisories/GHSA-r3j6-gpjw-qfjr","https://github.com/filamentphp/filament/pull/20335","https://github.com/filamentphp/filament/commit/b6bde8572bcac75d4f5b4ec892ba7b9e91e0ab4d","https://github.com/filamentphp/filament","https://github.com/filamentphp/filament/releases/tag/v4.12.6","https://github.com/filamentphp/filament/releases/tag/v5.7.6"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-r3j6-gpjw-qfjr","url":"https://osv.dev/vulnerability/GHSA-r3j6-gpjw-qfjr"}],"summary":"Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used"}