CVE-2025-69197 - CVE House
Back to Database
Status published Medium CVE-2025-69197

Pterodactyl TOTPs can be reused during validity window

Vulnerability Description

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficiently marked as used in the system. This allows an attacker who intercepts that token to use it in addition to a known username/password during the 60-second token validity window. The attacker must have intercepted a valid 2FA token (for example, during a screen share). This issue is fixed in version 1.12.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-69197

Credits & Attribution

No credits recorded in the NVD database.

References

More from pterodactyl

View All →
CVE-2025-69199
Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances
High 8.3
CVE-2025-69198
Pterodactyl's improper resource locking allows raced queries to create more resources than alloted
Medium 6
CVE-2025-68954
Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced
High 7.5
CVE-2025-49132
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
Critical 10
CVE-2024-49762
Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled
Medium 4.6

Affected Vendor

pterodactyl

View all reports →

Affected Software

panel
Vulnerable Versions:
< 1.12.0

Timeline

Official Publish: January 6th, 2026
Last Modified: January 6th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-287 CWE-294

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1556 Modify Authentication Process
Credential Access