5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48166

CVE-2026-48166: Filament: Timing-based user enumeration on login page

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, the login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email addresses. The impact is limited to disclosing whether an account exists for a given email. This vulnerability is fixed in 4.11.5 and 5.6.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48166

CVE-2026-48166:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
filament/filament	composer	>= 4.0.0, <= 4.11.4	4.11.5
filament/filament	composer	>= 5.0.0, <= 5.6.4	5.6.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a timing-based user enumeration issue in the login functionality of Filament. An attacker could measure the server's response time to login attempts to determine if a user account exists for a given email address. The analysis of the security patch, specifically commit 33a9f576efb0d43372607487aebd17eae4315f1f, reveals that the authenticate method in the Filament\Panels\Auth\Pages\Login class was the source of the vulnerability. The patch introduces the use of Illuminate\Support\Timebox to ensure that the authentication logic block executes in a near-constant time, whether the user exists or not. This effectively mitigates the timing attack by masking the time difference an attacker could observe. Therefore, the authenticate function is the key runtime indicator for this vulnerability.

Vulnerable functions

Filament\Panels\Auth\Pages\Login::authenticate

packages/panels/src/Auth/Pages/Login.php

This function is responsible for handling user login attempts. Before the patch, the execution time of this function would vary depending on whether the provided email address existed in the database. If the user did not exist, the function would return faster than if the user existed, because password validation would be skipped. This timing discrepancy allowed an attacker to enumerate valid user email addresses. The patch introduces a 'Timebox' which ensures that the authentication process takes a minimum amount of time, making the execution time constant whether the user exists or not, thus mitigating the timing attack.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.