The analysis of the provided patch commit 87ff60ad9b6e16d4e14ee36a220b8917dd7b0815 clearly indicates that the vulnerability is located in the verifyRecoveryCode function within the packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php file. The vulnerability description states that recovery codes can be used multiple times. The code change directly addresses this flaw. The original code would find a matching recovery code and immediately return true, without removing the used code from the user's stored recovery codes. The patched code changes this logic to ensure that once a recovery code is used, it is removed from the list of valid codes by saving a new list that excludes the used code. Therefore, any runtime profile during an exploit of this vulnerability would show the Filament\Panels\Auth\MultiFactor\App\AppAuthentication::verifyRecoveryCode function being executed.
Filament\Panels\Auth\MultiFactor\App\AppAuthentication::verifyRecoveryCodepackages/panels/src/Auth/MultiFactor/App/AppAuthentication.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| filament/filament | composer | >= 4.0.0, < 4.3.1 | 4.3.1 |