Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-67507 is a high-severity Improper Authentication (CWE-287) vulnerability in Filamentphp Filament. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique External Remote Services (T1133); ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-25 (Reference Monitor) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-67507 is a vulnerability in Filament, a collection of full-stack components for accelerated Laravel development. It affects versions 4.0.0 through 4.3.0 and stems from improper handling of recovery codes used in app-based multi-factor authentication (MFA). Specifically, the flaw allows the same recovery code to be reused indefinitely, bypassing intended one-time-use protections. This issue does not affect email-based MFA and only applies when recovery codes are enabled. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-287 (Improper Authentication) and CWE-288 (Authentication Bypass Using an Alternate Path or Channel).
Attackers can exploit this over the network without privileges or user interaction, though it requires high attack complexity. An unauthenticated adversary who obtains a single valid recovery code—potentially via phishing, compromise, or other means—can reuse it repeatedly to bypass app-based MFA. Successful exploitation enables unauthorized access to protected Laravel applications built with Filament, resulting in high impacts to confidentiality, integrity, and availability of affected systems.
Filament has addressed the issue in version 4.3.1. Administrators should upgrade to this patched release to mitigate the vulnerability. Additional details are available in the GitHub security advisory (GHSA-pvcv-q3q7-266g) and the fixing commit (87ff60ad9b6e16d4e14ee36a220b8917dd7b0815).
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-202172
Vulnerability Data
Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.3.0 contain a flaw in the handling of recovery codes for app-based multi-factor authentication, allowing the same recovery code to be reused indefinitely. This issue does…
more
not affect email-based MFA. It also only applies when recovery codes are enabled. This issue is fixed in version 4.3.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 15 hardening rules · 6 OS baselines
V6.4.4V6.5.4V6.5.5V6.5.7
Mitigating Controls (NIST 800-53 r5) AI
Requires a tamperproof, always-invoked reference monitor that structurally blocks bypass via any alternate path.
Enforces authorization checks on every logical access path, eliminating unauthenticated alternate channels.
Mandates unique identification and authentication of organizational users before access, directly stopping improper authentication.
Requires unique identification and authentication of devices before establishing connections, preventing unauthenticated device claims.
Mandates unique identification and authentication of non-organizational users, directly addressing the weakness for external actors.
Manages authenticators with verification and secure distribution, reducing opportunities for improper authentication.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Requiring authentication on every channel and path directly eliminates alternate-path bypasses.
PR.AA-04 directly enables verification of identity assertions (mostly preventing CWE-287 in that scope) yet leaves many other authentication failure modes unaddressed (only partial prevention overall).
Enforcing authorizations and least privilege across all access vectors prevents unauthenticated alternate paths.
Protecting networks and environments from unauthorized logical access blocks bypass via undocumented channels.
PR.AA-01 supplies and governs credentials/tokens that authentication relies on, removing some weak-credential cases, yet leaves verification logic, missing checks, and protocol flaws untouched.
PR.AA-02 ensures valid enrollment and unique credential binding, which reduces some improper-auth risks at issuance time but leaves runtime claim verification untouched, so each direction only partially addresses the other.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requiring authentication methods whose strength matches the sensitivity of the data and mandating multi-factor authentication directly blocks attempts to access resources without proving identity.
Verifying user identity before issuing replacement credentials and forcing changes after compromise reduces the likelihood that authentication bypass can be achieved through stolen or weak credentials.
Security testing can detect alternate-path bypasses but does not prevent them in production.
Access control policy directly addresses alternate authentication paths by requiring all channels to enforce authentication.
Mandating segregated approval and oversight for non-human identities reduces the chance that weak or orphaned credentials can be exploited for unauthorized authentication.
Access rights provisioning and review prevent bypass via unmonitored or alternate channels.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248598 There must be no ".shosts" files on the OL 8 operating system. prevents CWE-288
- V-248827 OL 8 must not have the rsh-server package installed. prevents CWE-287, CWE-288
Oracle Linux 9 (2 rules)
- V-271757 OL 9 file systems must not contain shosts.equiv files. prevents CWE-288
- V-271758 OL 9 file systems must not contain .shosts files. prevents CWE-288
RHEL 7 (4 rules)
- V-204425 The Red Hat Enterprise Linux operating system must be configured so that the SSH daemon does not allow authentication using an empty password. prevents CWE-287
- V-204440 Red Hat Enterprise Linux operating systems version 7.2 or newer using Unified Extensible Firmware Interface (UEFI) must require authentication upon booting into single-user and maintenance modes. prevents CWE-288
- V-204442 The Red Hat Enterprise Linux operating system must not have the rsh-server package installed. prevents CWE-287, CWE-288
RHEL 8 (1 rule)
- V-230492 RHEL 8 must not have the rsh-server package installed. prevents CWE-287
Ubuntu 22.04 (1 rule)
- V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. prevents CWE-287
Ubuntu 24.04 (2 rules)
- V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. prevents CWE-287
- V-270714 Ubuntu 24.04 LTS must not allow accounts configured in Pluggable Authentication Modules (PAM) with blank or null passwords. prevents CWE-287