PT-2026-1361 · Unknown · Pterodactyl

Published 2026-01-06 · Updated 2026-01-06 · CVE-2025-69197

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pterodactyl versions 1.11.11 and below

Description Pterodactyl, a game server management panel, has an issue where Time-based One-Time Password (TOTP) can be reused during its validity window. When a user with two-factor authentication (2FA) enabled signs in, the system does not properly mark the entered token as used. This allows an attacker who has intercepted a valid TOTP token, such as during a screen share, to use it multiple times in conjunction with a known username and password within the 60-second validity period of the token.

Recommendations Update to version 1.12.0 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-294

CWE-287

Related Identifiers

CVE-2025-69197

GHSA-RGMP-4873-R683

Affected Products

Pterodactyl

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69197.json · Exploit
• https://github.com/pterodactyl/panel/security/advisories/GHSA-rgmp-4873-r683 · Vendor Advisory
• https://github.com/pterodactyl/panel/commit/032bf076d92bb2f929fa69c1bac1b89f26b8badf · Patch
• https://osv.dev/vulnerability/CVE-2025-69197 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69197 · Security Note
• https://osv.dev/vulnerability/GHSA-rgmp-4873-r683 · Vendor Advisory
• https://github.com/pterodactyl/panel · Note
• https://github.com/pterodactyl/panel/releases/tag/v1.12.0 · Note
• https://t.me/CVEtracker/41454 · Telegram Post