Medium 6.5Published Jan 6, 2026

CVE-2025-69197Pterodactyl is a free, open-source game server management panel.

Updated under an hour ago (2026-10-19 06:20 UTC)

Does this affect you?

It affects pterodactyl panel. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for pterodactyl panel

Exploited in the last 30 days

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficiently marked as used in the system. This allows an attacker who intercepts that token to use it in addition to a known username/password during the 60-second token validity window. The attacker must have intercepted a valid 2FA token (for example, during a screen share). This issue is fixed in version 1.12.0.

CVSS: 6.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness (CWE): CWE-287, CWE-294
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Analyzed
Record last updated: Oct 7, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

pterodactyl panel pterodactyl:panel	before 1.12.0	NVD

References

https://github.com/pterodactyl/panel/commit/032bf076d92bb2f929fa69c1bac1b89f26b8badfpatch
https://github.com/pterodactyl/panel/releases/tag/v1.12.0product, release-notes
https://github.com/pterodactyl/panel/security/advisories/GHSA-rgmp-4873-r683vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.