← Vulnerability feed

Vulnerability record · CVE-2025-68954 · published 6 January 2026

CVE-2025-68954: Pterodactyl panel insufficient session expiration vulnerability

Pterodactyl · Panel

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.

7.5 CVSS 4.0 High EPSS 0.25% · top 85.8% CWE-613 · Insufficient session expiration
7.5CVSS 4.0 base score
0.25%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/pterodactyl/panel/commit/2bd9d8baddb0e0606e4a9d5be402f48678ac88d5 Patch
https://github.com/pterodactyl/panel/releases/tag/v1.12.0 ProductRelease Notes
https://github.com/pterodactyl/panel/security/advisories/GHSA-8c39-xppg-479c Vendor Advisory

Track CVE-2025-68954 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.2CVE-2026-26016Pterodactyl panel insecure direct object reference vulnerabilityWings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization…EPSS 0.46%8.8CVE-2023-32080Pterodactyl wings execution with unnecessary privileges vulnerabilityWings is the server control plane for Pterodactyl Panel. A vulnerability affecting versions prior to 1.7.5 and versions 1.11.0 prior to 1.11.6 impact…EPSS 0.92%8.8CVE-2023-25152Pterodactyl wings link following vulnerabilityWings is Pterodactyl's server control plane. Affected versions are subject to a vulnerability which can be used to create new files and directory str…EPSS 0.68%8.5CVE-2024-27102Pterodactyl wings path traversal vulnerabilityWings is the server control plane for Pterodactyl Panel. This vulnerability impacts anyone running the affected versions of Wings. The vulnerability …EPSS 0.55%8.4CVE-2024-34066Pterodactyl wings vulnerabilityPterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting…EPSS 0.54%8.3CVE-2026-21696Pterodactyl wings uncontrolled resource consumption vulnerabilityWings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to version 1…EPSS 0.54%8.3CVE-2025-69199Pterodactyl wings uncontrolled resource consumption vulnerabilityWings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.0, websockets within wings…EPSS 0.29%8.2CVE-2023-25168Pterodactyl wings link following vulnerabilityWings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vuln…EPSS 0.96%

Source: NIST National Vulnerability Database (record CVE-2025-68954), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.