The flaw occurs in the login flow of the Filament panel component. When a user with a valid password but insufficient panel access attempts to log in, the system presents a multi‑factor authentication (MFA) challenge before checking panel permissions. This vulnerability can be classified as CWE‑204, an information exposure flaw caused by incorrect handling of authentication and authorization logic. If the password is correct, the challenge appears; if it is incorrect, a generic failure is returned. This allows an unauthenticated attacker to determine whether a particular password is valid for that account, exposing credential validity information. The issue does not grant access or session creation; it only reveals password correctness.

Vulnerable to all users of filamentphp:filament running versions 4.0.0 through 4.12.4 and any 5.x release before 5.7.5, i.e., any release before the patched releases 4.12.5 and 5.7.5. Only accounts that have MFA enabled and are denied panel access are affected.

The CVSS score is 3.7, indicating low overall severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Nevertheless, an attacker with external network access can perform password‑guessing against accounts that do not allow panel entry, helping them identify valid credentials for enumeration. The exploit is surface‑level; it does not grant privilege escalation or persistent access. Because it requires MFA to be enabled and affects error message content, the value of the information disclosed is moderate but not critical.