← Vulnerability feed

Vulnerability record · CVE-2021-41176 · published 25 October 2021

CVE-2021-41176: Pterodactyl panel cross-site request forgery vulnerability

Pterodactyl · Panel

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted attack against a specific Panel instance, and serves only to sign a user out. **No user details are leaked, nor is any user data affected, this is simply an annoyance at worst.** This is fixed in version 1.6.3.

4.3 CVSS 3.1 Medium EPSS 0.52% · top 58.1% CWE-352 · Cross-site request forgery
4.3CVSS 3.1 base score, v2 4.3
0.52%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted attack against a specific Panel instance, and serves only to sign a user out. **No user details are leaked, nor is any user data affected, this is simply an annoyance at worst.** This is fixed in version 1.6.3.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/pterodactyl/panel/commit/45999ba4ee1b2dcb12b4a2fa2cedfb6b5d66fac2 PatchThird Party Advisory
https://github.com/pterodactyl/panel/releases/tag/v1.6.3 ProductThird Party Advisory
https://github.com/pterodactyl/panel/security/advisories/GHSA-m49f-hcxp-6hm6 Third Party Advisory
https://github.com/pterodactyl/panel/commit/45999ba4ee1b2dcb12b4a2fa2cedfb6b5d66fac2 PatchThird Party Advisory
https://github.com/pterodactyl/panel/releases/tag/v1.6.3 ProductThird Party Advisory
https://github.com/pterodactyl/panel/security/advisories/GHSA-m49f-hcxp-6hm6 Third Party Advisory

Track CVE-2021-41176 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.2CVE-2026-26016Pterodactyl panel insecure direct object reference vulnerabilityWings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization…EPSS 0.46%8.1CVE-2021-41129Pterodactyl panel deserialization of untrusted data vulnerabilityPterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a `confirmati…EPSS 1.8%7.5CVE-2025-68954Pterodactyl panel insufficient session expiration vulnerabilityPterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is remo…EPSS 0.25%7.5CVE-2019-1020002Pterodactyl panel observable discrepancy vulnerabilityPterodactyl before 0.7.14 with 2FA allows credential sniffing.EPSS 1.5%6.5CVE-2025-69197Pterodactyl panel improper authentication vulnerabilityPterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity …EPSS 0.36%6.1CVE-2024-34067Pterodactyl panel cross-site scripting vulnerabilityPterodactyl is a free, open-source game server management panel built with PHP, React, and Go. Importing a malicious egg or gaining access to wings i…EPSS 0.46%6.0CVE-2025-69198Pterodactyl panel uncontrolled resource consumption vulnerabilityPterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to the total number of resources…EPSS 0.24%4.3CVE-2021-41273Pterodactyl panel cross-site request forgery vulnerabilityPterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two rout…EPSS 0.39%

Source: NIST National Vulnerability Database (record CVE-2021-41176), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.