CVE-2025-69199

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.0, websockets within wings lack proper rate limiting and throttling. As a result a malicious user can open a large number of connections and then request data through these sockets, causing an excessive volume of data over the network and overloading the host system memory and cpu. Additionally, there is not a limit applied to the total size of messages being sent or received, allowing a malicious user to open thousands of websocket connections and then send massive volumes of information over the socket, overloading the host network, and causing increased CPU and memory load within Wings. Version 1.12.0 patches the issue.

• CWE-400
• CWE-770
• CWE-770

• https://github.com/pterodactyl/panel/security/advisories/GHSA-8w7m-w749-rx98Vendor Advisory

Published

Jan 19, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-69193Missing Authorization vulnerability in e-plugins WP Membersh…7.3
• CVE-2025-69194A security issue was discovered in GNU Wget2 when handling M…9.8
• CVE-2025-69195A flaw was found in GNU Wget2. This vulnerability, a stack-b…8.8
• CVE-2025-69196FastMCP is the standard framework for building MCP applicati…6.5
• CVE-2025-69197Pterodactyl is a free, open-source game server management pa…6.5
• CVE-2025-69198Pterodactyl is a free, open-source game server management pa…6.5
• CVE-2025-6920A flaw was found in the authentication enforcement mechanism…5.3
• CVE-2025-69200phpMyFAQ is an open source FAQ web application. In versions …7.5
• CVE-2025-69201Tugtainer is a self-hosted app for automating updates of doc…9.8
• CVE-2025-69202Axios Cache Interceptor is a cache interceptor for axios. Pr…6.5
• CVE-2025-69203Signal K Server is a server application that runs on a centr…8.8
• CVE-2025-69204ImageMagick is free and open-source software used for editin…7.5