High severity8.1OSV Advisory· Published Dec 10, 2025· Updated Jun 17, 2026

CVE-2025-67507

Description

Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.3.0 contain a flaw in the handling of recovery codes for app-based multi-factor authentication, allowing the same recovery code to be reused indefinitely. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. This issue is fixed in version 4.3.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
filament/filamentPackagist	>= 4.0.0, < 4.3.1	4.3.1

Affected products

Filamentphp/FilamentOSV2 versions
v4.0.0, v4.0.1, v4.0.10, …+ 1 more
- (no CPE)range: v4.0.0, v4.0.1, v4.0.10, …
- cpe:2.3:a:filamentphp:filament:*:*:*:*:*:*:*:*range: >=4.0.0,<4.3.1
ghsa-coords
pkg:composer/filament/filament
Range: >= 4.0.0, < 4.3.1

Patches

Vulnerability mechanics

References

github.com/filamentphp/filament/commit/87ff60ad9b6e16d4e14ee36a220b8917dd7b0815nvdPatchWEB
github.com/advisories/GHSA-pvcv-q3q7-266gghsaADVISORY
github.com/filamentphp/filament/security/advisories/GHSA-pvcv-q3q7-266gnvdVendor AdvisoryWEB
nvd.nist.gov/vuln/detail/CVE-2025-67507ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000