← Vulnerability feed

Vulnerability record · CVE-2025-69197 · published 6 January 2026

CVE-2025-69197: Pterodactyl panel improper authentication vulnerability

Pterodactyl · Panel

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficiently marked as used in the system. This allows an attacker who intercepts that token to use it in addition to a known username/password during the 60-second token validity window. The attacker must have intercepted a valid 2FA token (for example, during a screen share). This issue is fixed in version 1.12.0.

6.5 CVSS 3.1 Medium EPSS 0.36% · top 72.6% CWE-287 · Improper authenticationCWE-294 · Authentication bypass by capture-replay
6.5CVSS 3.1 base score
0.36%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficiently marked as used in the system. This allows an attacker who intercepts that token to use it in addition to a known username/password during the 60-second token validity window. The attacker must have intercepted a valid 2FA token (for example, during a screen share). This issue is fixed in version 1.12.0.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/pterodactyl/panel/commit/032bf076d92bb2f929fa69c1bac1b89f26b8badf Patch
https://github.com/pterodactyl/panel/releases/tag/v1.12.0 ProductRelease Notes
https://github.com/pterodactyl/panel/security/advisories/GHSA-rgmp-4873-r683 Vendor Advisory

Track CVE-2025-69197 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.2CVE-2026-26016Pterodactyl panel insecure direct object reference vulnerabilityWings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization…EPSS 0.46%8.1CVE-2021-41129Pterodactyl panel deserialization of untrusted data vulnerabilityPterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a `confirmati…EPSS 1.8%7.5CVE-2025-68954Pterodactyl panel insufficient session expiration vulnerabilityPterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is remo…EPSS 0.25%7.5CVE-2019-1020002Pterodactyl panel observable discrepancy vulnerabilityPterodactyl before 0.7.14 with 2FA allows credential sniffing.EPSS 1.5%6.1CVE-2024-34067Pterodactyl panel cross-site scripting vulnerabilityPterodactyl is a free, open-source game server management panel built with PHP, React, and Go. Importing a malicious egg or gaining access to wings i…EPSS 0.46%6.0CVE-2025-69198Pterodactyl panel uncontrolled resource consumption vulnerabilityPterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to the total number of resources…EPSS 0.24%4.3CVE-2021-41273Pterodactyl panel cross-site request forgery vulnerabilityPterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two rout…EPSS 0.39%4.3CVE-2021-41176Pterodactyl panel cross-site request forgery vulnerabilityPterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can …EPSS 0.52%

Source: NIST National Vulnerability Database (record CVE-2025-69197), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.