CVE-2025-69197: pterodactyl panel Improper Authentication

Vulnerability summary

CVE-2025-69197 is a medium (CVSS 6.5) Improper Authentication vulnerability in pterodactyl panel. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28% of scored vulnerabilities.

Timeline

1. 06-01-2026
   PublishedVulnerability first disclosed.
2. 06-01-2026
   Last modifiedVulnerability information updated.

Description

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficiently marked as used in the system. This allows an attacker who intercepts that token to use it in addition to a known username/password during the 60-second token validity window. The attacker must have intercepted a valid 2FA token (for example, during a screen share). This issue is fixed in version 1.12.0.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
• CWE-294Authentication Bypass by Capture-replayA capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).