Filament multi-factor authentication (app) recovery codes can be used multiple times
Published 9 Dec 2025 · Updated 10 Sept 2026
Affected package
- Affected
- >=4.0.0 <4.3.1
- Fixed in
- 4.3.1
composer require filament/filament:^4.3.1Details
A flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused indefinitely. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled.
If an attacker gains access to both the user's password and their recovery codes, they can repeatedly complete MFA without the user's app-based second factor. This weakens the expected security of MFA by turning recovery codes into a static, long-term bypass method.
Is GHSA-pvcv-q3q7-266g in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected filament/filament, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.