The vulnerability is a timing-based user enumeration flaw in Filament’s login page, observable from versions 4.0.0 through 4.11.5 and 5.6.5. By measuring the response time to different email addresses, an unauthenticated attacker can determine whether a given email is registered. The underlying weakness is a timing side channel (CWE‑208) that leaks confidential information about account existence but does not grant authentication or privilege escalation.

FilamentPHP’s Filament framework is affected. Any deployment using Filament versions 4.0.0 up to and including 4.11.5, or 5.6.5, is vulnerable. The issue is fixed in Filament 4.11.5 and 5.6.5 and later releases.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, suggesting a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attack involves sending login requests to the exposed login endpoint; the attacker only needs to observe response timing, making this a low-barrier, remote, unauthenticated attack with no privilege escalation required.