What’s Vulnerable › Vulnerabilities
CVE-2026-48166: Filament: Timing-based user enumeration on login page
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-22 · updated 2026-10-25
- Weakness: CWE-208
Description
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, the login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email addresses. The impact is limited to disclosing whether an account exists for a given email. This vulnerability is fixed in 4.11.5 and 5.6.5.
Affected products
- filamentphp filament: from 4.0.0, < 4.11.5; from 5.0.0, < 5.6.5
References
Get alerted when CVE-2026-48166 or the next vulnerability affects your stack