CVE-2019-1020002: Pterodactyl panel observable discrepancy vulnerability

Pterodactyl · Panel

Pterodactyl before 0.7.14 with 2FA allows credential sniffing.

7.5 CVSS 3.0 High EPSS 1.5% · top 27.2% CWE-203 · Observable discrepancy

7.5CVSS 3.0 base score, v2 5.0

1.5%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References

17 Jun 2026Last modified by NVD

Description

Pterodactyl before 0.7.14 with 2FA allows credential sniffing.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Panel Pterodactyl

References

Link	Tags
https://github.com/pterodactyl/panel/security/advisories/GHSA-vcm9-hx3q-qwj8	Third Party Advisory
https://github.com/pterodactyl/panel/security/advisories/GHSA-vcm9-hx3q-qwj8	Third Party Advisory

Track CVE-2019-1020002 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.2CVE-2026-26016Pterodactyl panel insecure direct object reference vulnerabilityWings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization…EPSS 0.46%19 Feb 2026 8.1CVE-2021-41129Pterodactyl panel deserialization of untrusted data vulnerabilityPterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a `confirmati…EPSS 1.8%6 Oct 2021 7.5CVE-2025-68954Pterodactyl panel insufficient session expiration vulnerabilityPterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is remo…EPSS 0.25%6 Jan 2026 6.5CVE-2025-69197Pterodactyl panel improper authentication vulnerabilityPterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity …EPSS 0.36%6 Jan 2026 6.1CVE-2024-34067Pterodactyl panel cross-site scripting vulnerabilityPterodactyl is a free, open-source game server management panel built with PHP, React, and Go. Importing a malicious egg or gaining access to wings i…EPSS 0.46%3 May 2024 6.0CVE-2025-69198Pterodactyl panel uncontrolled resource consumption vulnerabilityPterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to the total number of resources…EPSS 0.24%19 Jan 2026 4.3CVE-2021-41273Pterodactyl panel cross-site request forgery vulnerabilityPterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two rout…EPSS 0.39%17 Nov 2021 4.3CVE-2021-41176Pterodactyl panel cross-site request forgery vulnerabilityPterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can …EPSS 0.52%25 Oct 2021

Source: NIST National Vulnerability Database (record CVE-2019-1020002), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.