A critical authentication flaw in Filament versions 4.0.0 to 4.3.0 permits the reuse of multi-factor authentication recovery codes, significantly increasing the risk of unauthorized account access.

The vulnerability resides in the multi-factor authentication handling logic, where app-based recovery codes fail to invalidate after a single use. An unauthenticated attacker could leverage a previously captured or intercepted recovery code to bypass the secondary authentication layer.

Successful exploitation of this vulnerability allows an attacker to bypass multi-factor authentication, granting them unauthorized access to protected administrative or user accounts. Given the CVSS score of 8.1, this flaw poses a high risk to data confidentiality and integrity, potentially enabling full system compromise if administrative accounts are targeted.

Immediate Action: Update the Filament package to version 4.3.1 or later via your package manager to resolve the recovery code reuse issue.

Proactive Monitoring: Review authentication logs for suspicious patterns, specifically focusing on multiple successful logins using recovery codes for the same user account.

Compensating Controls: If an immediate update is not feasible, consider disabling app-based recovery codes or temporarily enforcing email-based MFA, which remains unaffected by this vulnerability.

Public Exploit Available: Unknown

The vulnerability represents a significant security oversight in the authentication workflow of the Filament framework. Organizations utilizing versions 4.0.0 through 4.3.0 should prioritize upgrading to 4.3.1 immediately to prevent potential bypass of multi-factor authentication. Failure to patch may expose sensitive systems to unauthorized access and potential account takeover.