Multiple Use of TOTP in Pterodactyl Game Server Management Panel

CVE-2025-69197

What is CVE-2025-69197?

The Pterodactyl Panel, an open-source game server management solution, has a vulnerability where Time-Based One-Time Password (TOTP) tokens can be reused within their valid time frame. This occurs because used tokens are not properly marked as invalid post-authentication, enabling an attacker who intercepts a valid token to exploit this flaw. By using the intercepted token alongside a known username and password during the 60-second validity window, an unauthorized user can gain access to the account. This critical issue was addressed and resolved in version 1.12.0.

References