CVE-2026-48166: Filament: Timing-based user enumeration on login page

June 23, 2026

The login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email addresses. The impact is limited to disclosing whether an account exists for a given email.

References

github.com/advisories/GHSA-5w46-g9pq-wh6f
github.com/filamentphp/filament/security/advisories/GHSA-5w46-g9pq-wh6f
nvd.nist.gov/vuln/detail/CVE-2026-48166

Code Behaviors & Features

Detect and mitigate CVE-2026-48166 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →