PT-2026-65515 · Unknown · Pterodactyl

CVE-2026-61609 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Pterodactyl versions 1.7.0 through 1.12.x

Description A flaw in the authentication rate limiter allows an unauthenticated attacker to cause a panel-wide denial of service. The system uses a single global bucket for the login and two-factor authentication checkpoint endpoints instead of tracking requests by IP address or account. Consequently, an attacker sending approximately ten requests per minute can exhaust the shared counter, resulting in HTTP 429 responses for all users, including administrators, who attempt to log in or complete two-factor authentication.

Technical details include:

• API Endpoints: POST /auth/login and POST /auth/login/checkpoint.
• Vulnerable Function: RouteServiceProvider::configureRateLimiting().

Because the POST /auth/login/checkpoint endpoint does not utilize reCAPTCHA, it provides a low-cost method for attackers to sustain this lockout state.

Recommendations Update to version 1.13.0. As a temporary mitigation, restrict access to the POST /auth/login and POST /auth/login/checkpoint endpoints to trusted IP addresses.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-61609

GHSA-XVC3-826V-XF47

Affected Products

Pterodactyl

References · 6

• 🔥 https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-61609 · Security Note
• https://osv.dev/vulnerability/GHSA-xvc3-826v-xf47 · Vendor Advisory
• https://github.com/pterodactyl/panel · Note
• https://github.com/pterodactyl/panel/releases/tag/v1.13.0 · Note
• https://github.com/pterodactyl/panel/commit/98079a01660a61980fe62a72b2c1d48f99c35a5e · Note