CVE-2021-41273

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints: Sending a test email and Generating a node auto-deployment token. At no point would any data be exposed to the malicious user, this would simply trigger email spam to an administrative user, or generate a single auto-deployment token unexpectedly. This token is not revealed to the malicious user, it is simply created unexpectedly in the system. This has been addressed in release `1.6.6`. Users may optionally manually apply the fixes released in v1.6.6 to patch their own systems.

• CWE-352
• CWE-352

• https://github.com/pterodactyl/panel/commit/bf9cbe2c6d5266c6914223e067c56175de7fc3a5Patch, Third Party Advisory
• https://github.com/pterodactyl/panel/security/advisories/GHSA-wwgq-9jhf-qgw6Patch, Third Party Advisory
• https://github.com/pterodactyl/panel/commit/bf9cbe2c6d5266c6914223e067c56175de7fc3a5Patch, Third Party Advisory
• https://github.com/pterodactyl/panel/security/advisories/GHSA-wwgq-9jhf-qgw6Patch, Third Party Advisory

Published

Nov 17, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41268Symfony/SecurityBundle is the security system for Symfony, a…8.8
• CVE-2021-41269cron-utils is a Java library to define, parse, validate, mig…9.8
• CVE-2021-4127An out of date graphics library (Angle) likely contained vul…9.8
• CVE-2021-41270Symfony/Serializer handles serializing and deserializing dat…6.5
• CVE-2021-41271Discourse is a platform for community discussion. In affecte…5.3
• CVE-2021-41272Besu is an Ethereum client written in Java. Starting in vers…7.5
• CVE-2021-41274solidus_auth_devise provides authentication services for the…8.8
• CVE-2021-41275spree_auth_devise is an open source library which provides a…8.8
• CVE-2021-41276Tuleap is a Libre and Open Source tool for end to end tracea…7.2
• CVE-2021-41277Metabase is an open source data analytics platform. In affec…7.5
• CVE-2021-41278Functions SDK for EdgeX is meant to provide all the plumbing…5.7
• CVE-2021-41279BaserCMS is an open source content management system with a …8.8