# CVE-2026-61609: Pterodactyl Panel authentication denial of service in login rate limiter

Source: https://junglewise.ai/threats/cve-2026-61609-pterodactyl-panel-authentication-denial-of-service-in-login-rate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-61609 · Severity: high · CVSS 7.5 · Published 2026-07-28

Pterodactyl, an open-source game server management panel, contains a flaw in how it limits login attempts. Instead of tracking attempts per user or per internet address, the system uses a single global counter for all users worldwide. An attacker can easily exhaust this counter by sending just ten requests per minute, which triggers a lockout for every single user on the system, including administrators, effectively preventing anyone from logging in.

Technologies: [pterodactyl/panel (Packagist)](https://junglewise.ai/threats/technologies/pterodactyl-panel), [Pterodactyl Panel](https://junglewise.ai/threats/technologies/panel). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Pterodactyl](https://junglewise.ai/threats/vendors/pterodactyl).

## Quick answers

**Is CVE-2026-61609 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61609 being exploited in the wild.

**How severe is CVE-2026-61609?** High severity, with a CVSS score of 7.5, published 28 July 2026.

**Which products and versions are affected?** pterodactyl/panel (Packagist) >= 1.7.0, <= 1.12.4, ECOSYSTEM:introduced=1.7.0,fixed=1.13.0; Pterodactyl Panel >= 1.7.0, < 1.13.0, >= 1.7.0, <= 1.12.4.

**Is there a fix for CVE-2026-61609?** Yes. pterodactyl/panel (Packagist): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61609 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-61609?** Check whether you run pterodactyl/panel (Packagist) or Pterodactyl Panel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pterodactyl/panel (Packagist): upgrade to 1.13.0 or later

  ```sh
  composer require pterodactyl/panel:^1.13.0
  ```


## Technical details

A denial of service vulnerability exists in Pterodactyl Panel versions 1.7.0 through 1.12.4 within the `RouteServiceProvider::configureRateLimiting()` method. The authentication rate limiter for the `POST /auth/login` and `POST /auth/login/checkpoint` (2FA) endpoints omits the `->by()` method call, causing Laravel to use a constant cache key (`md5('authentication')`) for all requests. An unauthenticated attacker can exhaust this global limit of 10 requests per minute from a single IP address, causing the server to return HTTP 429 (Too Many Requests) to all legitimate users attempting to authenticate. This issue is resolved in version 1.13.0 by correctly keying the rate limiter by the requester's IP address.

## Affected products

- Pterodactyl Panel >= 1.7.0, < 1.13.0

## Identifiers

- CVE-2026-61609
- GHSA-xvc3-826v-xf47

## Timeline

- 2021-06-15: patched: Version 1.13.0 released
- 2026-06-22: advisory: GitHub Security Advisory GHSA-xvc3-826v-xf47 published
- 2026-07-28: disclosed: CVE-2026-61609 published to NVD

## References

- [https://github.com/pterodactyl/panel/commit/98079a01660a61980fe62a72b2c1d48f99c35a5e](https://github.com/pterodactyl/panel/commit/98079a01660a61980fe62a72b2c1d48f99c35a5e)
- [https://github.com/pterodactyl/panel/releases/tag/v1.13.0](https://github.com/pterodactyl/panel/releases/tag/v1.13.0)
- [https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47](https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47)

## Related threats

- [Pterodactyl Panel privilege escalation in scheduled task creation](https://junglewise.ai/threats/cve-2026-86177-pterodactyl-panel-privilege-escalation-in-scheduled-task-creation)
- [Pterodactyl Panel and Wings privilege escalation via JWT scope reuse](https://junglewise.ai/threats/cve-2026-54593-pterodactyl-panel-and-wings-privilege-escalation-via-jwt-scope)
- [Pterodactyl Panel user enumeration in account email update endpoint](https://junglewise.ai/threats/pterodactyl-panel-user-enumeration-in-account-email-update-endpoint-89a5a182)
- [Pterodactyl Panel race condition in DatabaseController resource limits](https://junglewise.ai/threats/cve-2026-35202-pterodactyl-panel-race-condition-in-databasecontroller-resource)
- [Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization](https://junglewise.ai/threats/cve-2026-26016-pterodactyl-panel-allows-cross-node-server-configuration)