Les TOTP de Pterodactyl peuvent être réutilisés pendant la fenêtre de validité

This vulnerability presents a significant risk to Pterodactyl Panel deployments relying on 2FA for user authentication. An attacker who can intercept a valid 2FA token, such as during a screen share or through network sniffing, can gain unauthorized access to user accounts without needing to know the user's password. This bypass effectively negates the security benefits of 2FA, potentially leading to complete account compromise and control over the associated game servers or resources managed within the panel. The attack requires pre-existing knowledge of valid username/password combinations, limiting the scope but still posing a serious threat.

Pterodactyl Panel deployments utilizing 2FA are at risk, particularly those running versions prior to 1.12.0. Shared hosting environments where multiple users share the same panel instance are especially vulnerable, as a compromise of one user account could potentially expose others. Organizations relying on Pterodactyl Panel for critical game server management should prioritize patching.

• php: Examine Pterodactyl Panel logs for repeated login attempts with the same token, especially if they follow a pattern of successful login followed by immediate failure.

 grep '2FA token reused' /path/to/pterodactyl/logs/login.log

• generic web: Monitor access logs for unusual login patterns, such as a high volume of login attempts from a single IP address within a short timeframe.

 grep "login successful" /var/log/apache2/access.log | awk '{print $1}' | sort | uniq -c | sort -nr | head -10

1. 2026-01-06Disclosure

   disclosure

1. Réservé2025-12-29
2. Publiée2026-01-06
3. Modifiée2026-02-03
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-69197 is to upgrade Pterodactyl Panel to version 1.12.0 or later, which includes the fix for this vulnerability. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as shortening the token validity window to minimize the attack window. Monitor panel logs for suspicious login attempts and unusual activity. While a WAF cannot directly prevent this, it can be configured to detect and block suspicious login patterns. After upgrading, confirm the fix by attempting to replay a previously captured 2FA token with valid credentials – it should be rejected.

Dernière mise à jour

1.12.2récemment