Technical impact
The vulnerability is a timing-based user enumeration flaw in Filament’s login page, observable from versions 4.0.0 through 4.11.5 and 5.6.5. By measuring the response time to different email addresses, an unauthenticated attacker can determine whether a given email is registered. The underlying weakness is a timing side channel (CWE‑208) that leaks confidential information about account existence but does not grant authentication or privilege escalation.
Affected Systems
FilamentPHP’s Filament framework is affected. Any deployment using Filament versions 4.0.0 up to and including 4.11.5, or 5.6.5, is vulnerable. The issue is fixed in Filament 4.11.5 and 5.6.5 and later releases.
Risk and Exploitability
The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, suggesting a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attack involves sending login requests to the exposed login endpoint; the attacker only needs to observe response timing, making this a low-barrier, remote, unauthenticated attack with no privilege escalation required.
Github GHSA