-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe analysis of the provided patch commit 87ff60ad9b6e16d4e14ee36a220b8917dd7b0815 clearly indicates that the vulnerability is located in the verifyRecoveryCode function within the packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php file. The vulnerability description states that recovery codes can be used multiple times. The code change directly addresses this flaw. The original code would find a matching recovery code and immediately return true, without removing the used code from the user's stored recovery codes. The patched code changes this logic to ensure that once a recovery code is used, it is removed from the list of valid codes by saving a new list that excludes the used code. Therefore, any runtime profile during an exploit of this vulnerability would show the Filament\Panels\Auth\MultiFactor\App\AppAuthentication::verifyRecoveryCode function being executed.
Filament\Panels\Auth\MultiFactor\App\AppAuthentication::verifyRecoveryCodepackages/panels/src/Auth/MultiFactor/App/AppAuthentication.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| filament/filament | composer | >= 4.0.0, < 4.3.1 | 4.3.1 |