I would not leave a Filament v5 lock under 5.7 — app MFA with recovery codes was the hole

I would not leave a Filament v5 lock under 5.7 — app MFA with recovery codes was the hole

filament/filament ^5.0 resolves to v5.10.2 on Packagist as of 14 Oct 2026. CVE-2026-77567, the app-MFA bypass when recovery codes are on, was patched in 5.7.0, so a 5.0 tutorial lock is still the problem. Tables and forms are Livewire; I time that round trip before I blame the stylesheet.

· 9 min read #laravel #php #filament #admin #livewire #packages

Composer require, filament:install --panels, then composer show — stop under v5.7.0

Caption: The panel install is three commands. The one I actually trust is composer show filament/filament. v5.10.2 is what Packagist had on 13 Oct 2026. Anything under v5.7.0 is still inside CVE-2026-77567 when recovery codes are enabled.

Introduction

I wanted an admin panel on a throwaway Laravel app: resources, tables, and a login that can ask for an authenticator code. Filament v5 is that panel.

The queue note still says install 5.7.8, the tip on 1 Sep 2026. I am writing on 14 Oct 2026 (2026-W42). No row is tagged for this week, so this backup is the lowest undone priority. v5.10.2 was published 13 Oct 2026 (2026-10-13T22:49:59+00:00; GitHub tag 2026-10-13T22:48:54Z).

The security floor did not move with that tag. CVE-2026-77567 / GHSA-52xp-w8hr-xv3c is app multi-factor authentication bypassed when recovery codes are enabled. Affected 5.x is >= 5.0.0, < 5.7.0. Patched >= 5.7.0. The 4.x line of the same advisory is < 4.12.0, patched in 4.12.0. Email MFA is a different provider. This note is the v5 panel.

I did not composer require Filament on the VPS this morning. The lab is the v5 installation and MFA docs retrieved 14 Oct 2026, the published composer.json files at tag v5.10.2, and that advisory.

About the feature

A panel is the path I use. The installation page says PHP 8.2+, Laravel v11.28+, Tailwind CSS v4.1+, then:

composer require filament/filament:"^5.0"
php artisan filament:install --panels
php artisan make:filament-user

That writes app/Providers/Filament/AdminPanelProvider.php. If /admin errors, the same page says the provider has to be listed in bootstrap/providers.php. make:filament-user is the first account. I open /admin after that.

filament/filament on Packagist is the panels package. The monorepo root composer.json is Filament's own test suite (livewire/livewire sits in require-dev there). I read packages/panels/composer.json at v5.10.2: php ^8.2, composer-runtime-api ^2.1, chillerlan/php-qrcode ^5.0, pragmarx/google2fa ^8.0|^9.0, pragmarx/google2fa-qrcode ^3.0|^4.0, and the siblings filament/actions, forms, infolists, notifications, schemas, support, tables, widgets at self.version. I do not require those siblings myself.

filament/support at the same tag is where installs die: livewire/livewire ^4.4.7, ext-intl *, illuminate/contracts ^11.28|^12.0|^13.0. filament/tables also requires filament/query-builder at self.version. The v5 upgrade guide still says Livewire v4.0+ and Tailwind CSS v4.0+. The installation page says Tailwind v4.1+. I trust the support composer.json for Livewire and the installation page for Tailwind.

php artisan make:filament-resource Customer (docs, App\Models\Customer) creates CustomerResource, Livewire pages, a form schema, and CustomersTable. The list page is a full-page Livewire component. Search and sort post back to it.

App MFA is opt-in. The docs add nullable text columns app_authentication_secret and app_authentication_recovery_codes, two interfaces and traits on User, then AppAuthentication::make()->recoverable() next to ->profile(). Challenge state uses the default cache store. Every server in a multi-server deploy should share that store.

Direct requires of filament/filament, then what support and tables pull in

Caption: The arrow stops at the panels package's own require list. Livewire ^4.4.7, ext-intl, and illuminate/contracts come from filament/support. filament/query-builder comes from filament/tables. Tailwind is npm.

Why I picked it

This was the backup. No 2026-W42 row was waiting, so priority 19 is the first undone item.

I still open apps whose lock stopped on a 5.0 or 5.6 release while ->recoverable() is already in the panel provider. That pair is the advisory. v5.10.2's RTL, sort, and accessibility fixes do not patch a lock that never moved. Alex Six's 6 Aug 2026 insight is the other half of the queue note: v5.7.6 (5 Aug 2026) put the render work on the same minor line as the MFA fix (v5.7.0, 17 Jul 2026). v5.10.2 already contains both. I keep the current 5.10 line.

Where it can be used

I use it for an admin panel that enrolls an authenticator, with recovery codes, and for a resource list whose search and sort are Livewire requests. A customer table. An order table.

Email MFA is a different provider, so this CVE does not cover it. I still move a v5 lock to 5.7.0 or newer before anyone adds ->recoverable(). Monday's queue is the whole-app install. This one stays inside one Laravel app.

Benefit

On 5.7.0+ the authenticator code stays required unless recovery mode is on and the recovery code is not blank. I read that closure on tag v5.10.2, which also calls submitOnCompletion() on the code input. That call was not in the 14 Jul patch, so the method has grown since 5.7.0. The required rule is the part I grep.

On 5.7.6+ the render path is the one Six wrote up on 6 Aug. His internal numbers: a TextInput about 92% faster, and a 50-row table with five text columns and three row actions from 27.53 ms to 13.11 ms. One composer require pulls tables, forms, actions, and the TOTP libraries, with Livewire ^4.4.7 from filament/support.

Practical example from a recent application

Lab shape from the v5 docs and tag v5.10.2, not a named client. Confirm the lock before the panel provider grows recovery codes.

composer show filament/filament | sed -n '1,8p'
php -m | grep -i intl

I want versions : * v5.10.2 or any 5.7.0+, and intl in the module list. If the version line is v5.6.8 (that tag is 2 Jul 2026) or anything else under 5.7.0, I stop. The constraint in composer.json can already say ^5.0 while composer.lock is still old. Then:

composer update filament/filament -W
php artisan filament:install --panels

-W is the upgrade guide's flag so the Livewire major can move with Filament. A fresh app has no lock yet, so the installation command is enough.

The panel piece I would ship, from the MFA docs:

use Filament\Auth\MultiFactor\App\AppAuthentication;
use Filament\Panel;

public function panel(Panel $panel): Panel
{
    return $panel
        ->profile()
        ->multiFactorAuthentication([
            AppAuthentication::make()
                ->recoverable(),
        ]);
}

The table piece, from the resources and columns docs. CustomersTable::configure() is the class make:filament-resource Customer generates:

use Filament\Actions\BulkActionGroup;
use Filament\Actions\DeleteBulkAction;
use Filament\Actions\EditAction;
use Filament\Tables\Columns\TextColumn;
use Filament\Tables\Table;

public static function configure(Table $table): Table
{
    return $table
        ->columns([
            TextColumn::make('name')->searchable()->sortable(),
            TextColumn::make('email')->searchable(),
        ])
        ->recordActions([
            EditAction::make(),
        ])
        ->toolbarActions([
            BulkActionGroup::make([
                DeleteBulkAction::make(),
            ]),
        ]);
}

The docs' own note if that resource never shows in the nav: a model policy has to return true from viewAny().

Failure I would hit on a 5.6 lock, and still hit on 5.10 if Composer never solved. AdminPanelProvider already has ->recoverable(). composer show still says v5.6.8. That pair is the advisory.

On tag v5.6.8, getChallengeFormComponents() required the code with (! $isRecoverable) || blank($get('recoveryCode')). The recovery input was not required(), and its rule returns before verifyRecoveryCode() when the value is blank. Commit 45534a6 (14 Jul 2026) started from the other bad closure: the code was required only when recovery mode was off, and the recovery field itself was required(). Neither shape is 5.7.0. I am not writing the request that skips the factor.

On tag v5.10.2 the code field is:

->required(fn (Get $get): bool => (! $isRecoverable) || (! $get('useRecoveryCode')) || blank($get('recoveryCode')))

A blank recovery code does not satisfy the second factor. A non-blank one is checked with verifyRecoveryCode() only when that field's rule runs.

The other failure is the slow list. ListCustomers is Livewire, so the slow row in the browser is the search or sort request. v5.7.6 shortened server render time in Six's benchmark. I still measure that request before I open Tailwind.

Fix. Install php-intl so filament/support's "ext-intl": "*" can solve. A root requirement of livewire/livewire: ^3 conflicts with support's ^4.4.7. Bump filament/filament to 5.7.0 or newer (today 5.10.2). Grep vendor/filament/filament for blank($get('recoveryCode')) inside getChallengeFormComponents() before ->recoverable() stays. If the list is still slow, time the Livewire search request.

Password, then the code stays required unless recovery mode has a non-blank recovery code

Caption: After v5.7.0 the authenticator code is required unless recoverable(), recovery mode, and a non-blank recovery code are all true. Email MFA is a different provider. I read this closure on tag v5.10.2.

Search and sort hit the Livewire table component before any stylesheet

Caption: TextColumn::searchable() posts back to the list page. The resources docs call that page a full-page Livewire component.

Conclusion

What I would keep: filament/filament at 5.7.0+ (today v5.10.2), ext-intl, the Livewire ^4.4.7 floor from filament/support, and ->recoverable() only after composer show clears 5.7.0. The customer table stays a Livewire list. The CVE patch shipped in 5.7.0. v5.10.2 is the current tip, including later accessibility fixes, and it is the release I would install.

Next I would grep for AppAuthentication::make()->recoverable() and for a 4.x lock still under 4.12.0, the other half of the same advisory, then time one table search.

Did you hit the same wall?

I got stuck on composer show filament/filament still printing v5.6.8 while AppAuthentication::make()->recoverable() was already in the panel provider, and on a customer table that felt slow until the slow call was the Livewire search request. Did you hit the same thing — a ^5.0 constraint with an old lock, missing ext-intl, or a Livewire 3 requirement that will not solve against filament/support — or a different one? Tell me in the comments. I read them.

Need this done on your server?

I deploy and harden Laravel/CodeCanyon apps on cPanel or VPS, and offer monthly Server Watch retainers. Hire for deploy · Care plan

References

Share:

Get new posts in your inbox

No spam. One short email per new article — practical PHP, Laravel, devops, and AI-assisted workflows.

You might also like

I installed Pixelfed (Laravel) — the README skipped Horizon, Redis, and the image packages

I wanted a photo instance I actually own. Pixelfed is Laravel 12, and the homepage never tells you that Composer will OOM a 1GB VPS or that feeds stay empty until Horizon is a systemd service. Redis, Intervention Image, and Flysystem are the packages that decide whether the box is useful.

Sep 1, 2026 · 12 min read

PHP bcrypt still truncates at 72 bytes. The RFC did not ship.

On Ubuntu 24.04 PHP 8.3.6, password_hash still silently hashes the first 72 bytes. The 8.7 deprecation RFC has no yes votes; the author parked it for a gentler PASSWORD_BCRYPT_SHA256 draft. I would not invent E_DEPRECATED on today's CLI, and this is not a Laravel-core CVE.

Oct 9, 2026 · 9 min read

I would not count an OOM as a thrown exception on 13.33 — Laravel 13.34 shipped CountCrashesAsExceptions

13.34 lets a job opt in so a worker that dies (OOM, segfault, external kill) counts toward maxExceptions. Interruptible jobs receive SIGALRM before a timeout kill, and JobProcessed::$duration is milliseconds from the worker. queue:work --once and the sync driver still miss that timeout path. I would run composer show laravel/framework before I claim any of it.

Oct 7, 2026 · 9 min read

Comments

Powered by GitHub Discussions via Giscus. A free GitHub account is required.