CVE-2025-69197: 2FA Bypass in Pterodactyl Panel

This vulnerability presents a significant risk to Pterodactyl Panel deployments relying on 2FA for user authentication. An attacker who can intercept a valid 2FA token, such as during a screen share or through network sniffing, can gain unauthorized access to user accounts without needing to know the user's password. This bypass effectively negates the security benefits of 2FA, potentially leading to complete account compromise and control over the associated game servers or resources managed within the panel. The attack requires pre-existing knowledge of valid username/password combinations, limiting the scope but still posing a serious threat.

1. Reserved2025-12-29
2. Published2026-01-06
3. Modified2026-02-03
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-69197 is to upgrade Pterodactyl Panel to version 1.12.0 or later, which includes the fix for this vulnerability. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as shortening the token validity window to minimize the attack window. Monitor panel logs for suspicious login attempts and unusual activity. While a WAF cannot directly prevent this, it can be configured to detect and block suspicious login patterns. After upgrading, confirm the fix by attempting to replay a previously captured 2FA token with valid credentials – it should be rejected.