CVE-2025-69197

The record

When a user signs into an account with 2FA enabled they are prompted to enter a token. When that token is used, it is not sufficiently marked as used in the system allowing an attacker that intercepts that token to then use it in addition to a known username/password during the token validity window. This vulnerability requires that an attacker already be in possession of a valid username and password combination, and intercept a valid 2FA token (for example, during a screen share). The token must then be provided in addition to the username and password during the limited token validity window. The validity window is ~60 seconds as the Panel allows at most one additional window to the current one, each window being 30 seconds.

Affected packages

Related vulnerabilities

• GHSA-rgmp-4873-r683 Pterodactyl TOTPs can be reused during validity window Same vulnerability
• CVE-2026-26016 Wings is the server control plane for Pterodactyl, a free, open-source game server… Also affects pterodactyl/panel
• GHSA-g7vw-f8p5-c728 Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API… Also affects pterodactyl/panel
• GHSA-hr7j-63v7-vj7g Pterodactyl Panel's SFTP sessions remain active after user account deletion or password… Also affects pterodactyl/panel
• GHSA-jw2v-cq5x-q68g Pterodactyl improperly locks resources allowing raced queries to create more resources… Also affects pterodactyl/panel
• CVE-2025-69198 Pterodactyl is a free, open-source game server management panel. Also affects pterodactyl/panel
• GHSA-8c39-xppg-479c Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced Also affects pterodactyl/panel
• CVE-2025-68954 Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced Also affects pterodactyl/panel