This vulnerability allows an attacker to bypass app‑based multi‑factor authentication when recovery codes are enabled, due to incorrect required‑field handling in the challenge form. As a result, an attacker who has obtained or guessed a recovery code can log in without completing the second factor, effectively gaining unauthorized access to the user’s account. The primary impact is the loss of authentication integrity and potential compromise of sensitive data managed by the application.

The issue affects the Filament framework distributed by filamentphp, specifically all releases prior to version 4.12.0 and 5.7.0. Users deploying older versions of Filament in a Laravel application may be exposed to this authentication bypass.

The CVSS score of 8.1 indicates a high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker must control a user account that has MFA enabled and a valid recovery code token. The flaw resides in a web‑based challenge form, so exploitation is feasible over the application’s public interface, provided the attacker can supply a valid recovery code. The absence of a KEV listing suggests no known widespread exploitation yet, but the high severity warrants swift remediation.