Executive brief
Pterodactyl, an open-source game server management panel, contains a flaw in how it limits login attempts. Instead of tracking attempts per user or per internet address, the system uses a single global counter for all users worldwide. An attacker can easily exhaust this counter by sending just ten requests per minute, which triggers a lockout for every single user on the system, including administrators, effectively preventing anyone from logging in.
Technical details
A denial of service vulnerability exists in Pterodactyl Panel versions 1.7.0 through 1.12.4 within the `RouteServiceProvider::configureRateLimiting()` method. The authentication rate limiter for the `POST /auth/login` and `POST /auth/login/checkpoint` (2FA) endpoints omits the `->by()` method call, causing Laravel to use a constant cache key (`md5('authentication')`) for all requests. An unauthenticated attacker can exhaust this global limit of 10 requests per minute from a single IP address, causing the server to return HTTP 429 (Too Many Requests) to all legitimate users attempting to authenticate. This issue is resolved in version 1.13.0 by correctly keying the rate limiter by the requester's IP address.
Affected products
- Pterodactyl Panel >= 1.7.0, < 1.13.0
Timeline
- 2021-06-15: patched: Version 1.13.0 released
- 2026-06-22: advisory: GitHub Security Advisory GHSA-xvc3-826v-xf47 published
- 2026-07-28: disclosed: CVE-2026-61609 published to NVD