CVE-2025-67507

Filament's multi-factor authentication (app) recovery codes can be used multiple times

8.1 HighFix available

Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.3.0 contain a flaw in the handling of recovery codes for app-based multi-factor authentication, allowing the same recovery code to be reused indefinitely. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled. This issue is fixed in version 4.3.1.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.34%Up 0.3 points since Dec 10, 2025

What each source reports

CVE List Score used 8.1

Filament's multi-factor authentication (app) recovery codes can be used multiple times

Record: CVE-2025-67507
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-287, CWE-288
Updated: 2026-11-02

EUVDEUVD-2025-202172 8.1

Record: EUVD-2025-202172
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-pvcv-q3q7-266g 8.1

Filament multi-factor authentication (app) recovery codes can be used multiple times

A flaw in the handling of recovery codes for app-based multi-factor authentication allows the same recovery code to be reused indefinitely. This issue does not affect email-based MFA. It also only applies when recovery codes are enabled.

If an attacker gains access to both the user's password and their recovery codes, they can repeatedly complete MFA without the user's app-based second factor. This weakens the expected security of MFA by turning recovery codes into a static, long-term bypass method.

Record: GHSA-pvcv-q3q7-266g
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-287, CWE-288
Updated: 2026-11-02

NVD 8.1

Record: CVE-2025-67507
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-287, CWE-288
Updated: 2026-11-02

OSV 8.1

Filament's multi-factor authentication (app) recovery codes can be used multiple times

Record: CVE-2025-67507
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-287, CWE-288
Updated: 2026-11-02

OSVGHSA-pvcv-q3q7-266g 8.1

Filament multi-factor authentication (app) recovery codes can be used multiple times

Record: GHSA-pvcv-q3q7-266g
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-287, CWE-288
Updated: 2026-11-02

Affected products

filamentphp filament

Affected packages

Affected packages
Package	Affected	Fixed
`filament/filament` Packagist	4.0.0 up to 4.3.1	4.3.1
`filament/filament` Packagist	4.0.0 up to 4.3.1, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12 Show 33 moreShow less v4.0.13v4.0.14v4.0.15v4.0.16v4.0.17v4.0.18v4.0.19v4.0.2v4.0.20v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.1v4.1.10v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0v4.2.1v4.2.2v4.2.3v4.2.4v4.3.0	4.3.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-67507 is a high vulnerability (CVSS 8.1) in Filamentphp Filament, published December 9, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 28th percentile. Fixed in filament/filament 4.3.1.