Executive brief
Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled
Affected products
- Packagist pterodactyl/panel
Junglewise Threat Intelligence
CVE-2024-49762: Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled
CVE-2024-49762 · Severity: low · CVSS 3.1 · Published 2024-10-24
Technologies: pterodactyl/panel (Packagist). Vendors: Packagist.
Related threats
- Pterodactyl Panel authentication denial of service in login rate limiter
- Pterodactyl Panel and Wings privilege escalation via JWT scope reuse
- Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system
- Pterodactyl Panel user enumeration in account email update endpoint
- Pterodactyl Panel race condition in DatabaseController resource limits