-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| filament/filament | composer | >= 4.0.0, < 4.3.1 | 4.3.1 |
Miggo AIRoot Cause AnalysisThe analysis of the provided patch commit 87ff60ad9b6e16d4e14ee36a220b8917dd7b0815 clearly indicates that the vulnerability is located in the verifyRecoveryCode method of the Filament\Panels\Auth\MultiFactor\App\AppAuthentication class. The vulnerability allowed for the reuse of multi-factor authentication recovery codes because the function would validate a code without subsequently invalidating it. An attacker who had compromised a user's password and their recovery codes could therefore maintain persistent access. The patch rectifies this by ensuring that once a recovery code is used, it is removed from the list of valid codes for the user, thus preventing its reuse. The added test case in the commit further confirms this was the intended fix for the security flaw.
Filament\Panels\Auth\MultiFactor\App\AppAuthentication::verifyRecoveryCodepackages/panels/src/Auth/MultiFactor/App/AppAuthentication.php