CVE-2025-69197 Pterodactyl TOTPs can be reused during validity window
Attackers can reuse intercepted TOTP codes to bypass two-factor authentication and take over accounts in Pterodactyl panels.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-69197?
CVE-2025-69197 is a medium-severity authentication bypass vulnerability in pterodactyl panel, published on 6 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficiently marked as used in the system. This allows an attacker who intercepts that token to use it in addition to a known username/password during the 60-second token validity window. The attacker must have intercepted a valid 2FA token (for example, during a screen share). This issue is fixed in version 1.12.0.
Which versions are affected by CVE-2025-69197?
2 open source packages ship an affected version, including pterodactyl/panel. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pterodactyl/panel Packagist | All versions | 1.12.0 |
pterodactyl/panel Packagist | All versions | 1.12.0 |
Products include Pterodactyl Panel.
How do I fix CVE-2025-69197?
Upgrade pterodactyl/panel to 1.12.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-69197 being exploited?
There is no known exploitation of CVE-2025-69197 in the wild and no public exploit code.
Other vulnerabilities in pterodactyl panel
- CVE-2026-26016 Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization
- CVE-2021-41129 Authentication bypass in Pterodactyl
- CVE-2025-68954 Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced
- CVE-2019-1020002 Pterodactyl vulnerable to 2FA Sniffing
- CVE-2024-34067 Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel
Sources
Also known as GHSA-rgmp-4873-r683.