p PatchFirst

CVE-2025-69197

CVE-2025-69197 · Pterodactyl TOTPs can be reused during validity window

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficiently marked as used in the system. This allows an attacker who intercepts that token to use it in addition to a known username/password during the 60-second token validity window. The attacker must have intercepted a valid 2FA token (for example, during a screen share). This issue is fixed in version 1.12.0.

CVSS 6.5 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • panel

    Versions
    • < 1.12.0: Affected

    No fix published

  • pterodactyl/panel Packagist

    Versions
    • v0.1.0-beta
    • v0.1.1-beta
    • v0.1.2-beta
    • v0.2.0-beta
    • v0.3.0-beta
    • v0.4.0-beta
    • v0.4.1-beta
    • v0.5.0
    • v0.5.0-rc.1
    • v0.5.0-rc.2
    • v0.5.1
    • v0.5.2
    • v0.5.3
    • v0.5.4
    • v0.5.5
    • v0.5.6
    • v0.5.7
    • v0.6.0
    • v0.6.0-beta.1
    • v0.6.0-beta.2
    • v0.6.0-beta.2.1
    • v0.6.0-rc.1
    • v0.6.1
    • v0.6.2
    • v0.6.3
    • v0.6.4
    • v0.7.0
    • v0.7.0-beta.1
    • v0.7.0-beta.2
    • v0.7.0-beta.3
    • v0.7.0-beta.4
    • v0.7.0-rc.1
    • v0.7.0-rc.2
    • v0.7.1
    • v0.7.10
    • v0.7.11
    • v0.7.12
    • v0.7.13
    • v0.7.14
    • v0.7.15
    • v0.7.16
    • v0.7.17
    • v0.7.18
    • v0.7.19
    • v0.7.2
    • v0.7.3
    • v0.7.4
    • v0.7.5
    • v0.7.6
    • v0.7.7
    • v0.7.8
    • v0.7.9
    • v0.8.0-alpha.1
    • v0.8.0-alpha.2
    • v1.0.0
    • v1.0.0-beta.1
    • v1.0.0-beta.2
    • v1.0.0-beta.3
    • v1.0.0-beta.4
    • v1.0.0-beta.5
    • v1.0.0-beta.6
    • v1.0.0-beta.7
    • v1.0.0-rc.1
    • v1.0.0-rc.2
    • v1.0.0-rc.3
    • v1.0.0-rc.4
    • v1.0.0-rc.5
    • v1.0.0-rc.6
    • v1.0.0-rc.7
    • v1.0.1
    • v1.0.2
    • v1.0.3
    • v1.1.0
    • v1.1.1
    • v1.1.2
    • v1.1.3
    • v1.10.0
    • v1.10.1
    • v1.10.2
    • v1.10.3
    • v1.10.4
    • v1.11.0
    • v1.11.0-rc.1
    • v1.11.0-rc.2
    • v1.11.1
    • v1.11.10
    • v1.11.11
    • v1.11.2
    • v1.11.3
    • v1.11.4
    • v1.11.5
    • v1.11.6
    • v1.11.7
    • v1.11.8
    • v1.11.9
    • v1.2.0
    • v1.2.1
    • v1.2.2
    • v1.3.0
    • v1.3.1
    • v1.3.2
    • v1.4.0
    • v1.4.1
    • v1.4.2
    • v1.5.0
    • v1.5.1
    • v1.6.0
    • v1.6.1
    • v1.6.2
    • v1.6.3
    • v1.6.5
    • v1.6.6
    • v1.7.0
    • v1.8.0
    • v1.8.1
    • v1.9.0
    • v1.9.1
    • v1.9.2
    Affected ranges
    • ECOSYSTEM: < 1.12.0

    Update to 1.12.0

Original sources

Check your server →