CVE-2025-68954: pterodactyl panel Insufficient Session Expiration

Vulnerability summary

CVE-2025-68954 is a high (CVSS 7.5) Insufficient Session Expiration vulnerability in pterodactyl panel. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.4% of scored vulnerabilities.

Timeline

1. 06-01-2026
   PublishedVulnerability first disclosed.
2. 06-01-2026
   Last modifiedVulnerability information updated.

Description

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.

• CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."