CVE-2026-48166

Filament: Timing-based user enumeration on login page

State: Published
Severity: 5.3 Medium
Published: Jun 22, 2026
Updated: Jun 23, 2026
Reserved: May 20, 2026

Description

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, the login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email addresses. The impact is limited to disclosing whether an account exists for a given email. This vulnerability is fixed in 4.11.5 and 5.6.5.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	GitHub_M

Weaknesses

CWE-208 Observable Timing Discrepancy

Affected Products

Product	Versions
filamentfilamentphp	>= 4.0.0, < 4.11.5Affected >= 5.0.0, < 5.6.5Affected

References

https://github.com/filamentphp/filament/security/advisories/GHSA-5w46-g9pq-wh6f

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.