CVE-2026-61609: Pterodactyl Panel authentication denial of service in login rate limiter

CVE-2026-61609 · Severity: high · CVSS 7.5 · Published 2026-07-28

Pterodactyl, an open-source game server management panel, contains a flaw in how it limits login attempts. Instead of tracking attempts per user or per internet address, the system uses a single global counter for all users worldwide. An attacker can easily exhaust this counter by sending just ten requests per minute, which triggers a lockout for every single user on the system, including administrators, effectively preventing anyone from logging in.

Technologies: pterodactyl/panel (Packagist), Pterodactyl Panel. Vendors: Packagist, Pterodactyl.

Quick answers

Is CVE-2026-61609 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61609 being exploited in the wild.
How severe is CVE-2026-61609?
High severity, with a CVSS score of 7.5, published 28 July 2026.
Which products and versions are affected?
pterodactyl/panel (Packagist) >= 1.7.0, <= 1.12.4, ECOSYSTEM:introduced=1.7.0,fixed=1.13.0; Pterodactyl Panel >= 1.7.0, < 1.13.0, >= 1.7.0, <= 1.12.4.
Is there a fix for CVE-2026-61609?
Yes. pterodactyl/panel (Packagist): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61609 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-61609?
Check whether you run pterodactyl/panel (Packagist) or Pterodactyl Panel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pterodactyl/panel (Packagist): upgrade to 1.13.0 or later
    composer require pterodactyl/panel:^1.13.0

Technical details

A denial of service vulnerability exists in Pterodactyl Panel versions 1.7.0 through 1.12.4 within the `RouteServiceProvider::configureRateLimiting()` method. The authentication rate limiter for the `POST /auth/login` and `POST /auth/login/checkpoint` (2FA) endpoints omits the `->by()` method call, causing Laravel to use a constant cache key (`md5('authentication')`) for all requests. An unauthenticated attacker can exhaust this global limit of 10 requests per minute from a single IP address, causing the server to return HTTP 429 (Too Many Requests) to all legitimate users attempting to authenticate. This issue is resolved in version 1.13.0 by correctly keying the rate limiter by the requester's IP address.

Affected products

  • Pterodactyl Panel >= 1.7.0, < 1.13.0

Identifiers

  • CVE-2026-61609
  • GHSA-xvc3-826v-xf47

Timeline

  • 2021-06-15: patched: Version 1.13.0 released
  • 2026-06-22: advisory: GitHub Security Advisory GHSA-xvc3-826v-xf47 published
  • 2026-07-28: disclosed: CVE-2026-61609 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.