CVE-2026-54593

The record

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server_uuid, user_uuid, and unique_id claims without checking the token's intended purpose; because the Panel issues JWTs carrying those same claims for lower-privilege operations such as WebSocket authentication and file-download links, an authenticated subuser could reuse one of those tokens (for example a WebSocket token obtained with only the websocket.connect permission) by replaying it against /upload/file to write arbitrary files to the same server, despite never being granted the file.create permission. This issue is fixed in Panel version 1.12.3 and Wings version 1.12.2.

Affected packages

Related vulnerabilities

• CVE-2026-58429 Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints CWE-1259
• CVE-2026-25700 Improper Restriction of Security Token Assignment vulnerability in Apache Answer. CWE-1259
• CVE-2026-40264 OpenBao is an open source identity-based secrets management system. CWE-1259
• CVE-2024-29371 In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by… CWE-1259
• CVE-2026-19636 An issue was identified in which CSRF tokens were generated using a predictable method… CWE-1270
• CVE-2026-49499 Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of… CWE-1270
• CVE-2025-59698 Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7… CWE-1270