Is CVE-2026-48166 exploitable?

No community verdicts yet for CVE-2026-48166. Be the first to weigh in.

Is CVE-2026-48166 a false positive?

No community verdicts yet for CVE-2026-48166.

How do I remediate CVE-2026-48166?

See the authoritative references (NVD, vendor advisory) and community field notes on this page for remediation guidance.

CVE-2026-48166

is CVE-2026-48166real, exploitable, or a false positive? Here's the community verdict.

☆ Watch

Medium · CVSS 5.3EPSS 0.2%CWE-208

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, the login page has an observable timing discrepancy that allows unauthenticated attackers to enumerate registered email addresses. The impact is limited to disclosing whether an account exists for a given email. This vulnerability is fixed in 4.11.5 and 5.6.5.

References

NVD MITRE CVE.org

Published Jun 22, 2026

Embed this verdict

Markdown

[![TruePositive verdict](https://www.truepositive.app/cve/CVE-2026-48166/badge.svg)](https://www.truepositive.app/cve/CVE-2026-48166)

HTML

<a href="https://www.truepositive.app/cve/CVE-2026-48166"><img src="https://www.truepositive.app/cve/CVE-2026-48166/badge.svg" alt="TruePositive verdict for CVE-2026-48166"></a>

Live badge that updates automatically as the community verdict changes.

Community ground truth

In your experience, is this finding real and exploitable?

0 verdicts

Not a real issue

No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.

Field notes & remediation

Verdicts are the quick signal. Notes are the evidence and fixes behind them.

No notes yet. Be the first to share what you saw, or a fix that worked.

Add a field note or remediationoptional