TI-2025-42651 Aliases CVE-2025-69197 GHSA-rgmp-4873-r683

Pterodactyl TOTPs can be reused during validity window

LOW 29CWE-287Published 2026-01-06 · Updated 2026-01-06

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficiently marked as used in the system. This allows an attacker who intercepts that token to use it in addition to a known username/password during the 60-second token validity window. The attacker must have intercepted a valid 2FA token (for example, during a screen share). This issue is fixed in version 1.12.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00356 29th percentileScored 2026-11-07

Fix Fixed panel (pterodactyl): 1.12.0pterodactyl/panel (Packagist): 1.12.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pterodactyl	panel	before 1.12.0	1.12.0	Patch available	CNA
—	pterodactyl/panel (Packagist)	before 1.12.0	1.12.0	Patch available	GHSA-rgmp-4873-r683

panel Vendorpterodactyl Affected before 1.12.0 Fixed in 1.12.0 Patch available CNA
pterodactyl/panel (Packagist) Vendor— Affected before 1.12.0 Fixed in 1.12.0 Patch available GHSA-rgmp-4873-r683

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pterodactyl:panel::::::::	before 1.12.0	Vulnerable	pterodactyl

cpe:2.3:a:pterodactyl:panel:*:*:*:*:*:*:*:* Versions before 1.12.0 Vulnerable ·pterodactyl

Remediation

Fix · CNA panel (pterodactyl) Fixed in 1.12.0
Fix · GHSA-rgmp-4873-r683 pterodactyl/panel (Packagist) Fixed in 1.12.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-69197
2026-10-03 Alias added: GHSA-rgmp-4873-r683

References

Patch 1

https://github.com/pterodactyl/panel/commit/032bf076d92bb2f929fa69c1bac1b89f26b8badf

Advisory 2

Other 2

TI-2026-21030 Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization CVSS 4.0CRITICAL 9.2
TI-2021-17968 Authentication bypass in Pterodactyl CVSS 3.1HIGH 8.1
TI-2019-16080 Pterodactyl before 0.7.14 with 2FA allows credential sniffing. CVSS 3.0HIGH 7.5
TI-2025-42410 Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced CVSS 4.0HIGH 7.5
TI-2024-22525 Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel CVSS 3.1MEDIUM 6.1
TI-2025-42652 Pterodactyl's improper resource locking allows raced queries to create more resources than alloted CVSS 4.0MEDIUM 6.0

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences