Listen to this Post
In FilamentPHP, when app-based multi-factor authentication is enabled with recovery codes, these codes are designed for one-time use to regain access if the MFA device is lost. However, due to a flaw in the code logic, the system does not invalidate or remove a recovery code after it has been used for authentication. This means that once a recovery code is consumed during login, it remains active in the user’s account and can be presented again for future authentication attempts. An attacker who obtains both the user’s password and one of their recovery codes—for example, through phishing, database leaks, or malware—can repeatedly bypass the app-based second factor by reusing the same recovery code. This effectively turns the recovery code into a static, long-term backup credential that undermines the dynamic nature of MFA. The vulnerability exists only when recovery codes are enabled for app-based MFA; email-based MFA is not affected. The issue likely stems from missing code to update the recovery code status in the database after successful use, allowing persistent validity.
Platform: FilamentPHP
Version: Not specified
Vulnerability: MFA Recovery Code Reuse
Severity: High
Date: Dec 9, 2025
Prediction: Patch expected within 14 days
What Undercode Say:
Analytics
Check FilamentPHP MFA configuration
php artisan filament:status
List recovery codes in database (hypothetical table)
sqlite3 storage/database.sqlite “SELECT user_id, code FROM mfa_recovery_codes;”
Code snippet illustrating flaw (simplified)
// In Filament MFA handler
public function verifyRecoveryCode($user, $inputCode) {
if (in_array($inputCode, $user->recovery_codes)) {
// Vulnerability: code not invalidated after use
return true; // Allows reuse
}
return false;
}
How Exploit:
Attacker uses stolen password and recovery code to bypass MFA repeatedly.
Protection from this CVE:
Disable recovery codes, apply patch, use email MFA.
Impact:
Unauthorized account access, reduced MFA security.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
