MEDIUM🇬🇧 English

CVE-2025-69197

CVSS 6.5v3.1pub. 2026-01-06upd. 2026-01-12

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficiently marked as used in the system. This allows an attacker who intercepts that token to use it in addition to a known username/password during the 60-second token validity window. The attacker must have intercepted a valid 2FA token (for example, during a screen share). This issue is fixed in version 1.12.0.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

  • Pterodactyl Panel

    APP
    Pterodactyl
    < 1.12.0
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Auth Bypass
CWE
Referencje

Powiązane podatności

CVE-2026-26016CRITICAL9.2PL ✓ten sam produkt

Brak autoryzacji w Pterodactyl Wings — dostęp do danych serwerów innych węzłów

CVE-2025-68954HIGH7.5ten sam produkt

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke acti...

CVE-2021-41129HIGH8.1ten sam produkt

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user c...

CVE-2019-1020002HIGH7.5ten sam produkt

Pterodactyl before 0.7.14 with 2FA allows credential sniffing.

CVE-2025-69198MEDIUM6.0ten sam produkt

Pterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are a...