An attacker who obtains a user's password and a single app‑based MFA code can reuse that code for the remainder of the configured time window, typically about four minutes, even after the legitimate account uses a newer code. This allows the attacker to impersonate the user without being blocked by the repeated‑use check, thereby compromising the account’s confidentiality and potentially allowing further attacks within that window.

Filament PHP, versions 4.0.0 through 4.12.5 and 5.7.0 through 5.7.5, which contain the vulnerable authentication cache logic. Versions 4.12.6 and 5.7.6 and later have the fix applied.

The CVSS score of 6.5 indicates moderate severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through a web or application interface, requiring an attacker to have the user’s password and an app‑based MFA code. The attack is feasible during the MFA time window and can be repeated within that period, potentially exposing sensitive actions performed by the user.