CVE-2025-69197
📋 TL;DR
This vulnerability in Pterodactyl allows attackers to reuse intercepted TOTP 2FA tokens within their 60-second validity window. Users with 2FA enabled are affected, as an attacker who captures a valid token (e.g., via screen sharing) can bypass authentication. The issue occurs because used tokens aren't properly marked as consumed in versions 1.11.11 and below.
💻 Affected Systems
- Pterodactyl Panel
📦 What is this software?
Panel by Pterodactyl
⚠️ Risk & Real-World Impact
Worst Case
Account takeover of any user with 2FA enabled, allowing attackers to gain administrative control over game servers and potentially access sensitive data.
Likely Case
Targeted account compromise of users whose 2FA tokens are intercepted through social engineering or screen sharing attacks.
If Mitigated
Limited impact with proper network segmentation and monitoring, though authentication bypass remains possible.
🎯 Exploit Status
Exploitation requires intercepting a valid 2FA token (e.g., via screen capture, phishing) and having valid credentials. The 60-second window limits attack opportunities.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.12.0
Vendor Advisory: https://github.com/pterodactyl/panel/security/advisories/GHSA-rgmp-4873-r683
Restart Required: Yes
Instructions:
1. Backup your current installation. 2. Update to version 1.12.0 via the release page. 3. Run database migrations. 4. Restart the panel service.
🔧 Temporary Workarounds
Disable 2FA temporarily
allTemporarily disable two-factor authentication for all users until patching is complete.
Implement rate limiting
allAdd rate limiting on authentication endpoints to prevent token reuse attempts.
🧯 If You Can't Patch
- Monitor authentication logs for multiple login attempts with the same token within 60 seconds.
- Implement network segmentation to limit access to the Pterodactyl panel to trusted networks only.
🔍 How to Verify
Check if Vulnerable:
Check if your Pterodactyl version is 1.11.11 or below and if 2FA is enabled for any users.Check Version:
Check the panel version in the admin settings or via the web interface.Verify Fix Applied:
Confirm version is 1.12.0 or higher and test that TOTP tokens cannot be reused within their validity window.📡 Detection & Monitoring
Log Indicators:
- Multiple authentication attempts with the same TOTP token within 60 seconds
- Successful logins from unusual IP addresses shortly after legitimate logins
Network Indicators:
- Unusual authentication traffic patterns
- Multiple login requests from different IPs with same credentials
SIEM Query:
source="pterodactyl" AND (event="authentication" AND token_reuse=true) OR (multiple_login_attempts within 60s)