CVE-2025-68954

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.

• CWE-613

• https://github.com/pterodactyl/panel/commit/2bd9d8baddb0e0606e4a9d5be402f48678ac88d5Patch
• https://github.com/pterodactyl/panel/releases/tag/v1.12.0Product, Release Notes
• https://github.com/pterodactyl/panel/security/advisories/GHSA-8c39-xppg-479cVendor Advisory

Published

Jan 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68949n8n is an open source workflow automation platform. From 1.3…5.3
• CVE-2025-6895The Melapress Login Security plugin for WordPress is vulnera…9.8
• CVE-2025-68950ImageMagick is free and open-source software used for editin…6.2
• CVE-2025-68951phpMyFAQ is an open source FAQ web application. Versions 4.0…6.1
• CVE-2025-68952Eigent is a multi-agent Workforce. In version 0.0.60, a 1-cl…9.8
• CVE-2025-68953Frappe is a full-stack web application framework. Versions 1…7.5
• CVE-2025-68955Multi-thread race condition vulnerability in the card framew…4.7
• CVE-2025-68956Multi-thread race condition vulnerability in the card framew…4.7
• CVE-2025-68957Multi-thread race condition vulnerability in the card framew…4.7
• CVE-2025-68958Multi-thread race condition vulnerability in the card framew…4.7
• CVE-2025-68959Permission verification bypass vulnerability in the media li…5.5
• CVE-2025-6896A vulnerability classified as critical has been found in D-L…8.8