PT-2025-50298 · Filament · Filament

Published 2025-12-10 · Updated 2026-03-04 · CVE-2025-67507

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Filament versions 4.0.0 through 4.3.0

Description Filament, a collection of full-stack components for accelerated Laravel development, has an issue in how it manages recovery codes for application-based multi-factor authentication. The flaw allows the same recovery code to be reused repeatedly. This does not impact email-based multi-factor authentication and only occurs when recovery codes are enabled.

Recommendations Update to version 4.3.1 or later.

Exploit

Fix

Authentication Bypass Using an Alternate Path or Channel

Improper Authentication

Weakness Enumeration

CWE-288

CWE-287

Related Identifiers

CVE-2025-67507

GHSA-PVCV-Q3Q7-266G

Affected Products

Filament

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67507.json · Exploit
• https://github.com/filamentphp/filament/commit/87ff60ad9b6e16d4e14ee36a220b8917dd7b0815 · Patch
• https://github.com/filamentphp/filament/security/advisories/GHSA-pvcv-q3q7-266g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67507 · Security Note
• https://osv.dev/vulnerability/CVE-2025-67507 · Vendor Advisory
• https://twitter.com/cracbot/status/2000521270514102493 · Twitter Post
• https://t.me/CVEtracker/39327 · Telegram Post
• https://t.me/cveNotify/145282 · Telegram Post
• https://twitter.com/CVEnew/status/1998732755065262203 · Twitter Post
• https://t.me/cveNotify/154200 · Telegram Post