CVE-2025-69197: medium-severity vulnerability in pterodactyl panel
Pterodactyl TOTPs can be reused during validity window
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.4%
Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficiently marked as used in the system. This allows an attacker who intercepts that token to use it in addition to a known username/password during the 60-second token validity window. The attacker must have intercepted a valid 2FA token (for example, during a screen share). This issue is fixed in version 1.12.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
pterodactyl · panelRelated CVEs — pterodactyl panel
In the same product, most dangerous first.
CVE-2025-49132CRITICALPterodactyl Panel Allows Unauthenticated Arbitrary Remote Code ExecutionEPSS 54.5%CVE-2021-41129HIGHAuthentication bypass in PterodactylEPSS 1.8%CVE-2026-54593HIGHPterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissionsEPSS 0.7%CVE-2026-86177HIGHPterodactyl Panel before 1.14.1 Privilege Escalation via Schedule TasksEPSS 0.6%CVE-2021-41176MEDIUMlogout CSRF in Pterodactyl PanelEPSS 0.5%CVE-2026-61609HIGHPterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)EPSS 0.5%