Pterodactyl Panel up to 1.11.x TOTP improper authentication

Summaryinfo

A vulnerability identified as critical has been detected in Pterodactyl Panel up to 1.11.x. The impacted element is an unknown function of the component TOTP. Performing a manipulation results in improper authentication. This vulnerability is identified as CVE-2025-69197. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Pterodactyl Panel up to 1.11.x. It has been classified as critical. This affects some unknown functionality of the component TOTP. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality. The summary by CVE is:

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficiently marked as used in the system. This allows an attacker who intercepts that token to use it in addition to a known username/password during the 60-second token validity window. The attacker must have intercepted a valid 2FA token (for example, during a screen share). This issue is fixed in version 1.12.0.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-69197 since 12/29/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available.

Upgrading to version 1.12.0 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 032bf076d92bb2f929fa69c1bac1b89f26b8badf is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Pterodactyl

Name

• Panel

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11

License

• open-source

Website

• Product: https://github.com/pterodactyl/panel/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion