The flaw allows an attacker who has both a user's password and the recovery codes to submit the same code multiple times concurrently, creating more than one authenticated session per code. The issue stems from a race condition (CWE-362) and improper state handling (CWE-841). This defeats the intended single‑use guarantee of recovery codes, substantially extending the attacker's window of access.

The vulnerability affects Filament versions 4.0.0 through 4.11.5 and 5.6.5. Only app‑based multi‑factor authentication with recovery codes enabled is impacted; email‑based MFA is unaffected.

The CVSS score of 7.4 indicates moderate‑to‑high severity. EPSS data is unavailable and the flaw is not listed in CISA KEV, so the current exploitation probability remains uncertain. An attacker must acquire the victim’s password and recovery codes and then submit them from multiple concurrent sessions, a path that is feasible through normal application usage once credentials are compromised.