Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

pterodactyl/panel

14 known vulnerabilities (2 critical, 4 high, 6 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
14 · 2 critical, 4 high, 6 medium, 1 low
Registry
Packagist

Advisories 14

  • Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

    Affected: from 1.7.0, fixed in 1.13.0.

  • Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

    Affected: fixed in 1.12.3.

  • Pterodactyl has a database resource limit bypass via race condition in Client API

    Affected: fixed in 1.12.3.

  • CVE-2026-26016Critical 9.2

    Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization

    Affected: fixed in 1.12.1.

  • CVE-2025-69198Medium 6.0

    Pterodactyl's improper resource locking allows raced queries to create more resources than alloted

    Affected: fixed in 1.12.0.

  • CVE-2025-69197Medium 6.5

    Pterodactyl TOTPs can be reused during validity window

    Affected: fixed in 1.12.0.

  • Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced

    Affected: fixed in 1.12.0.

  • CVE-2025-49132Critical 10.0

    Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

    Affected: fixed in 1.11.11.

  • CVE-2024-49762Medium 4.6

    Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled

    Affected: fixed in 1.11.8.

  • CVE-2024-34067Medium 6.1

    Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel

    Affected: fixed in 1.11.6.

  • CVE-2021-41273Medium 4.3

    Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys

    Affected: fixed in 1.6.6.

  • CVE-2021-41176Medium 4.3

    logout CSRF in Pterodactyl Panel

    Affected: from 1.0.0, fixed in 1.6.3.

  • Authentication bypass in Pterodactyl

    Affected: from 1.0.0, fixed in 1.6.2.

  • Pterodactyl before 0.7.14 with 2FA allows credential sniffing.

    Affected: fixed in 0.7.14.