Vulnerability-Lookup

CVE-2026-61609 (GCVE-0-2026-61609)

Vulnerability from cvelistv5 – Published: 2026-07-28 15:45 – Updated: 2026-07-28 19:28

Title

Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

Summary

Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting() applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the fall-through Limit::perMinute(10) covering POST /auth/login and POST /auth/login/checkpoint omitted ->by(), so Laravel derived a constant cache key (md5('authentication')) shared by every request. An unauthenticated attacker sending roughly ten requests per minute from a single IP, most cheaply against the checkpoint endpoint (which has no reCAPTCHA), exhausts the shared counter and causes HTTP 429 for every user attempting to log in or complete two-factor authentication, a panel-wide authentication denial of service that also locks out administrators. This issue is fixed in version 1.13.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-28 19:27 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8035 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/pterodactyl/panel/security/adv…	x_refsource_CONFIRM
https://github.com/pterodactyl/panel/commit/98079…	x_refsource_MISC
https://github.com/pterodactyl/panel/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
pterodactyl	panel	Affected: >= 1.7.0, < 1.13.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-61609",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T19:27:43.426874Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T19:28:14.470Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "panel",
          "vendor": "pterodactyl",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.7.0, \u003c 1.13.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting() applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the fall-through Limit::perMinute(10) covering POST /auth/login and POST /auth/login/checkpoint omitted -\u003eby(), so Laravel derived a constant cache key (md5(\u0027authentication\u0027)) shared by every request. An unauthenticated attacker sending roughly ten requests per minute from a single IP, most cheaply against the checkpoint endpoint (which has no reCAPTCHA), exhausts the shared counter and causes HTTP 429 for every user attempting to log in or complete two-factor authentication, a panel-wide authentication denial of service that also locks out administrators. This issue is fixed in version 1.13.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T15:45:57.570Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47"
        },
        {
          "name": "https://github.com/pterodactyl/panel/commit/98079a01660a61980fe62a72b2c1d48f99c35a5e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pterodactyl/panel/commit/98079a01660a61980fe62a72b2c1d48f99c35a5e"
        },
        {
          "name": "https://github.com/pterodactyl/panel/releases/tag/v1.13.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pterodactyl/panel/releases/tag/v1.13.0"
        }
      ],
      "source": {
        "advisory": "GHSA-xvc3-826v-xf47",
        "discovery": "UNKNOWN"
      },
      "title": "Pterodactyl\u0027s shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-61609",
    "datePublished": "2026-07-28T15:45:57.570Z",
    "dateReserved": "2026-07-10T17:36:04.597Z",
    "dateUpdated": "2026-07-28T19:28:14.470Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-61609",
      "date": "2026-11-01",
      "epss": "0.00498",
      "percentile": "0.42668"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "panel",
                "vendor": "pterodactyl",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 1.7.0, \u003c 1.13.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting() applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the fall-through Limit::perMinute(10) covering POST /auth/login and POST /auth/login/checkpoint omitted -\u003eby(), so Laravel derived a constant cache key (md5(\u0027authentication\u0027)) shared by every request. An unauthenticated attacker sending roughly ten requests per minute from a single IP, most cheaply against the checkpoint endpoint (which has no reCAPTCHA), exhausts the shared counter and causes HTTP 429 for every user attempting to log in or complete two-factor authentication, a panel-wide authentication denial of service that also locks out administrators. This issue is fixed in version 1.13.0."
          },
          {
            "lang": "es",
            "value": "Pterodactyl es un panel de gesti\u00f3n de servidores de juegos gratuito y de c\u00f3digo abierto. Desde la versi\u00f3n 1.7.0 hasta la 1.13.0, el limitador de tasa de autenticaci\u00f3n definido en RouteServiceProvider::configureRateLimiting() aplic\u00f3 un \u00fanico \u2019bucket\u2019 global a los puntos finales de inicio de sesi\u00f3n y de punto de control de doble factor en lugar de usar la IP o la cuenta como clave: el Limit::perMinute(10) predeterminado que cubr\u00eda POST /auth/login y POST /auth/login/checkpoint omiti\u00f3   -\u003e  by(), por lo que Laravel deriv\u00f3 una clave de cach\u00e9 constante (md5(\u2019authentication\u2019)) compartida por cada solicitud. Un atacante no autenticado que env\u00eda aproximadamente diez solicitudes por minuto desde una \u00fanica IP, de la manera m\u00e1s econ\u00f3mica contra el punto final de punto de control (que no tiene reCAPTCHA), agota el contador compartido y causa HTTP 429 para cada usuario que intenta iniciar sesi\u00f3n o completar la autenticaci\u00f3n de doble factor, una denegaci\u00f3n de servicio de autenticaci\u00f3n a nivel de panel que tambi\u00e9n bloquea a los administradores. Este problema est\u00e1 solucionado en la versi\u00f3n 1.13.0."
          }
        ],
        "id": "CVE-2026-61609",
        "lastModified": "2026-10-24T13:10:00.147",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-61609",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T19:27:43.426874Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-28T16:19:28.693",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pterodactyl/panel/commit/98079a01660a61980fe62a72b2c1d48f99c35a5e"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pterodactyl/panel/releases/tag/v1.13.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-770"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-61609",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-28T19:27:43.426874Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-28T19:28:10.311Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "panel",
              "vendor": "pterodactyl",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 1.7.0, \u003c 1.13.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting() applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the fall-through Limit::perMinute(10) covering POST /auth/login and POST /auth/login/checkpoint omitted -\u003eby(), so Laravel derived a constant cache key (md5(\u0027authentication\u0027)) shared by every request. An unauthenticated attacker sending roughly ten requests per minute from a single IP, most cheaply against the checkpoint endpoint (which has no reCAPTCHA), exhausts the shared counter and causes HTTP 429 for every user attempting to log in or complete two-factor authentication, a panel-wide authentication denial of service that also locks out administrators. This issue is fixed in version 1.13.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-770",
                  "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-28T15:45:57.570Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47"
            },
            {
              "name": "https://github.com/pterodactyl/panel/commit/98079a01660a61980fe62a72b2c1d48f99c35a5e",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/pterodactyl/panel/commit/98079a01660a61980fe62a72b2c1d48f99c35a5e"
            },
            {
              "name": "https://github.com/pterodactyl/panel/releases/tag/v1.13.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/pterodactyl/panel/releases/tag/v1.13.0"
            }
          ],
          "source": {
            "advisory": "GHSA-xvc3-826v-xf47",
            "discovery": "UNKNOWN"
          },
          "title": "Pterodactyl\u0027s shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-61609",
        "datePublished": "2026-07-28T15:45:57.570Z",
        "dateReserved": "2026-07-10T17:36:04.597Z",
        "dateUpdated": "2026-07-28T19:28:14.470Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-61609

Vulnerability from fkie_nvd - Published: 2026-07-28 16:19 - Updated: 2026-10-24 13:10

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/pterodactyl/panel/commit/98079a01660a61980fe62a72b2c1d48f99c35a5e
	security-advisories@github.com	https://github.com/pterodactyl/panel/releases/tag/v1.13.0
	security-advisories@github.com	https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "panel",
          "vendor": "pterodactyl",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.7.0, \u003c 1.13.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting() applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the fall-through Limit::perMinute(10) covering POST /auth/login and POST /auth/login/checkpoint omitted -\u003eby(), so Laravel derived a constant cache key (md5(\u0027authentication\u0027)) shared by every request. An unauthenticated attacker sending roughly ten requests per minute from a single IP, most cheaply against the checkpoint endpoint (which has no reCAPTCHA), exhausts the shared counter and causes HTTP 429 for every user attempting to log in or complete two-factor authentication, a panel-wide authentication denial of service that also locks out administrators. This issue is fixed in version 1.13.0."
    },
    {
      "lang": "es",
      "value": "Pterodactyl es un panel de gesti\u00f3n de servidores de juegos gratuito y de c\u00f3digo abierto. Desde la versi\u00f3n 1.7.0 hasta la 1.13.0, el limitador de tasa de autenticaci\u00f3n definido en RouteServiceProvider::configureRateLimiting() aplic\u00f3 un \u00fanico \u2019bucket\u2019 global a los puntos finales de inicio de sesi\u00f3n y de punto de control de doble factor en lugar de usar la IP o la cuenta como clave: el Limit::perMinute(10) predeterminado que cubr\u00eda POST /auth/login y POST /auth/login/checkpoint omiti\u00f3   -\u003e  by(), por lo que Laravel deriv\u00f3 una clave de cach\u00e9 constante (md5(\u2019authentication\u2019)) compartida por cada solicitud. Un atacante no autenticado que env\u00eda aproximadamente diez solicitudes por minuto desde una \u00fanica IP, de la manera m\u00e1s econ\u00f3mica contra el punto final de punto de control (que no tiene reCAPTCHA), agota el contador compartido y causa HTTP 429 para cada usuario que intenta iniciar sesi\u00f3n o completar la autenticaci\u00f3n de doble factor, una denegaci\u00f3n de servicio de autenticaci\u00f3n a nivel de panel que tambi\u00e9n bloquea a los administradores. Este problema est\u00e1 solucionado en la versi\u00f3n 1.13.0."
    }
  ],
  "id": "CVE-2026-61609",
  "lastModified": "2026-10-24T13:10:00.147",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-61609",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-28T19:27:43.426874Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-28T16:19:28.693",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pterodactyl/panel/commit/98079a01660a61980fe62a72b2c1d48f99c35a5e"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pterodactyl/panel/releases/tag/v1.13.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-XVC3-826V-XF47

Vulnerability from github – Published: 2026-07-28 14:57 – Updated: 2026-07-28 14:57

Summary

Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

Details

Summary

The authentication rate limiter used for the login and two-factor checkpoint endpoints applies a single global bucket shared by every client, instead of keying per IP or per account. An unauthenticated attacker sending ~10 requests per minute from one IP exhausts the shared bucket and causes HTTP 429 for every user on every IP attempting to log in or complete 2FA, for as long as the attack is sustained. This is a trivially triggered, unauthenticated, panel-wide authentication denial of service.

Details

In app/Providers/RouteServiceProvider::configureRateLimiting() the limiter is defined as:

RateLimiter::for('authentication', function (Request $request) {
    if ($request->route()->named('auth.post.forgot-password')) {
        return Limit::perMinute(2)->by($request->ip());
    }

    return Limit::perMinute(10);
});

The forgot-password branch is correctly scoped with ->by($request->ip()). The fall-through return, which covers POST /auth/login and POST /auth/login/checkpoint (see routes/auth.php, the throttle:authentication group), omits ->by() entirely.

For a named limiter, Laravel 11 derives the cache key as md5($limiterName . $limit->key) (Illuminate\Routing\Middleware\ThrottleRequests::handleRequestUsingNamedLimiter). Limit::perMinute(10) is constructed with an empty key, so the resolved key is md5('authentication'), a constant identical for every incoming request. All clients therefore contend for one shared counter rather than one counter per source.

Two factors make this worse: - throttle:authentication is registered as group middleware in routes/auth.php, so it increments before the route-level recaptcha middleware on POST /auth/login. Requests count toward the limit regardless of reCAPTCHA outcome. - POST /auth/login/checkpoint has no reCAPTCHA at all, giving an attacker a clean, low-cost way to fill the shared bucket with malformed requests.

Once the 10/minute global limit is hit, the throttle returns 429 to all subsequent requests on those endpoints until the one-minute window decays. Repeating the burst each minute holds the panel in a permanent locked-out state for all legitimate users.

PoC

Stand up a default Pterodactyl panel.
From a single attacker IP, exhaust the shared bucket via the checkpoint endpoint (no reCAPTCHA):

for i in $(seq 1 11); do
  curl -s -o /dev/null -w "%{http_code}\n" \
    -X POST https://panel.example.com/auth/login/checkpoint \
    -H 'Content-Type: application/json' \
    -H 'X-Requested-With: XMLHttpRequest' \
    -d '{"confirmation_token":"x","authentication_code":"000000"}'
done

Requests 1-10 return a normal 4xx (validation/auth failure); request 11 returns 429 Too Many Requests.

From a completely different IP and a valid account, attempt a normal login:

curl -s -o /dev/null -w "%{http_code}\n" \
  -X POST https://panel.example.com/auth/login \
  -H 'Content-Type: application/json' \
  -H 'X-Requested-With: XMLHttpRequest' \
  -d '{"user":"valid@example.com","password":"correct-horse"}'

This returns 429 despite being a different IP, different account, and valid credentials. Looping step 2 once per minute keeps every user locked out indefinitely.

Impact

This is an unauthenticated availability attack against authentication. Any internet-facing Pterodactyl panel can be made unusable for all users (login and 2FA verification both blocked) by a single low-bandwidth attacker, with no credentials, no privileges, and no user interaction. Administrators are locked out alongside regular users, hampering incident response. The forgot-password endpoint is unaffected because it is correctly keyed per IP.

Suggested fix: key the fall-through limit by request source, at minimum:

return Limit::perMinute(10)->by($request->ip());

Ideally combine the IP with the submitted identifier for login (e.g. ->by($request->ip() . '|' . (string) $request->input('user'))) and the IP plus confirmation token for the checkpoint, so brute-force protection per account is preserved while removing the shared global bucket.

Disclaimer

This report was written by AI, the bug itself was found and confirmed by the reporter.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.12.4"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "pterodactyl/panel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.0"
            },
            {
              "fixed": "1.13.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61609"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-28T14:57:59Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nThe `authentication` rate limiter used for the login and two-factor checkpoint endpoints applies a single global bucket shared by every client, instead of keying per IP or per account. An unauthenticated attacker sending ~10 requests per minute from one IP exhausts the shared bucket and causes HTTP 429 for every user on every IP attempting to log in or complete 2FA, for as long as the attack is sustained. This is a trivially triggered, unauthenticated, panel-wide authentication denial of service.\n\n### Details\nIn `app/Providers/RouteServiceProvider::configureRateLimiting()` the limiter is defined as:\n\n```php\nRateLimiter::for(\u0027authentication\u0027, function (Request $request) {\n    if ($request-\u003eroute()-\u003enamed(\u0027auth.post.forgot-password\u0027)) {\n        return Limit::perMinute(2)-\u003eby($request-\u003eip());\n    }\n\n    return Limit::perMinute(10);\n});\n```\n\nThe forgot-password branch is correctly scoped with `-\u003eby($request-\u003eip())`. The fall-through return, which covers `POST /auth/login` and `POST /auth/login/checkpoint` (see `routes/auth.php`, the `throttle:authentication` group), omits `-\u003eby()` entirely.\n\nFor a named limiter, Laravel 11 derives the cache key as `md5($limiterName . $limit-\u003ekey)` (`Illuminate\\Routing\\Middleware\\ThrottleRequests::handleRequestUsingNamedLimiter`). `Limit::perMinute(10)` is constructed with an empty `key`, so the resolved key is `md5(\u0027authentication\u0027)`, a constant identical for every incoming request. All clients therefore contend for one shared counter rather than one counter per source.\n\nTwo factors make this worse:\n- `throttle:authentication` is registered as group middleware in `routes/auth.php`, so it increments before the route-level `recaptcha` middleware on `POST /auth/login`. Requests count toward the limit regardless of reCAPTCHA outcome.\n- `POST /auth/login/checkpoint` has no reCAPTCHA at all, giving an attacker a clean, low-cost way to fill the shared bucket with malformed requests.\n\nOnce the 10/minute global limit is hit, the throttle returns 429 to all subsequent requests on those endpoints until the one-minute window decays. Repeating the burst each minute holds the panel in a permanent locked-out state for all legitimate users.\n\n### PoC\n1. Stand up a default Pterodactyl panel.\n2. From a single attacker IP, exhaust the shared bucket via the checkpoint endpoint (no reCAPTCHA):\n\n```bash\nfor i in $(seq 1 11); do\n  curl -s -o /dev/null -w \"%{http_code}\\n\" \\\n    -X POST https://panel.example.com/auth/login/checkpoint \\\n    -H \u0027Content-Type: application/json\u0027 \\\n    -H \u0027X-Requested-With: XMLHttpRequest\u0027 \\\n    -d \u0027{\"confirmation_token\":\"x\",\"authentication_code\":\"000000\"}\u0027\ndone\n```\n\nRequests 1-10 return a normal 4xx (validation/auth failure); request 11 returns `429 Too Many Requests`.\n\n3. From a completely different IP and a valid account, attempt a normal login:\n\n```bash\ncurl -s -o /dev/null -w \"%{http_code}\\n\" \\\n  -X POST https://panel.example.com/auth/login \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -H \u0027X-Requested-With: XMLHttpRequest\u0027 \\\n  -d \u0027{\"user\":\"valid@example.com\",\"password\":\"correct-horse\"}\u0027\n```\n\nThis returns `429` despite being a different IP, different account, and valid credentials. Looping step 2 once per minute keeps every user locked out indefinitely.\n\n### Impact\nThis is an unauthenticated availability attack against authentication. Any internet-facing Pterodactyl panel can be made unusable for all users (login and 2FA verification both blocked) by a single low-bandwidth attacker, with no credentials, no privileges, and no user interaction. Administrators are locked out alongside regular users, hampering incident response. The forgot-password endpoint is unaffected because it is correctly keyed per IP.\n\nSuggested fix: key the fall-through limit by request source, at minimum:\n\n```php\nreturn Limit::perMinute(10)-\u003eby($request-\u003eip());\n```\n\nIdeally combine the IP with the submitted identifier for login (e.g. `-\u003eby($request-\u003eip() . \u0027|\u0027 . (string) $request-\u003einput(\u0027user\u0027))`) and the IP plus confirmation token for the checkpoint, so brute-force protection per account is preserved while removing the shared global bucket.\n\n### Disclaimer\nThis report was written by AI, the bug itself was found and confirmed by the reporter.",
  "id": "GHSA-xvc3-826v-xf47",
  "modified": "2026-07-28T14:57:59Z",
  "published": "2026-07-28T14:57:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pterodactyl/panel"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pterodactyl\u0027s shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-61609 (GCVE-0-2026-61609)

FKIE_CVE-2026-61609

GHSA-XVC3-826V-XF47

Summary

Details

PoC

Impact

Disclaimer

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour