CVE-2025-69197 json
Pterodactyl TOTPs can be reused during validity window
published 2026-01-06 10 mo ago modified 2026-10-07 33 d ago also EUVD-2026-1040 , GHSA-rgmp-4873-r683
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 29%
- public exploits
- 0
- none known
Summary
Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficiently marked as used in the system. This allows an attacker who intercepts that token to use it in addition to a known username/password during the 60-second token validity window. The attacker must have intercepted a valid 2FA token (for example, during a screen share). This issue is fixed in version 1.12.0.
Patch / fix
- packagist pterodactyl/panel 1.12.0
- pterodactyl panel 1.12.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10 mo ago
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | pterodactyl/panel | <1.12.0 |
1.12.0 |
Affected products
- pterodactyl panel
Classification
References
-
github.com
/pterodactyl/panel/commit/032bf076d92bb2f929fa69c1bac1b89f26b8badf
web, patch
-
github.com
/pterodactyl/panel/security/advisories/GHSA-rgmp-4873-r683
web, vendor-advisory
-
github.com
/pterodactyl/panel/releases/tag/v1.12.0
web, product, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2025-69197
advisory
-
github.com
/pterodactyl/panel
package
Sources
- CVE List CVE-2025-69197
- GitHub Advisory GHSA-rgmp-4873-r683
- NVD CVE-2025-69197
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.