CVE-2025-69197

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficiently marked as used in the system. This allows an attacker who intercepts that token to use it in addition to a known username/password during the 60-second token validity window. The attacker must have intercepted a valid 2FA token (for example, during a screen share). This issue is fixed in version 1.12.0.

• CWE-287
• CWE-294

• https://github.com/pterodactyl/panel/commit/032bf076d92bb2f929fa69c1bac1b89f26b8badfPatch
• https://github.com/pterodactyl/panel/releases/tag/v1.12.0Product, Release Notes
• https://github.com/pterodactyl/panel/security/advisories/GHSA-rgmp-4873-r683Vendor Advisory

Published

Jan 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-69191Missing Authorization vulnerability in e-plugins ListingHub …7.3
• CVE-2025-69192Missing Authorization vulnerability in e-plugins Real Estate…7.3
• CVE-2025-69193Missing Authorization vulnerability in e-plugins WP Membersh…7.3
• CVE-2025-69194A security issue was discovered in GNU Wget2 when handling M…9.8
• CVE-2025-69195A flaw was found in GNU Wget2. This vulnerability, a stack-b…8.8
• CVE-2025-69196FastMCP is the standard framework for building MCP applicati…6.5
• CVE-2025-69198Pterodactyl is a free, open-source game server management pa…6.5
• CVE-2025-69199Wings is the server control plane for Pterodactyl, a free, o…6.5
• CVE-2025-6920A flaw was found in the authentication enforcement mechanism…5.3
• CVE-2025-69200phpMyFAQ is an open source FAQ web application. In versions …7.5
• CVE-2025-69201Tugtainer is a self-hosted app for automating updates of doc…9.8
• CVE-2025-69202Axios Cache Interceptor is a cache interceptor for axios. Pr…6.5