Multiple Use of TOTP in Pterodactyl Game Server Management Panel
CVE-2025-69197

6.5MEDIUM

Key Information:

Vendor: Pterodactyl
Status: Panel
Vendor: CVE Published:; 6 January 2026

🔔 Create Pterodactyl Vulnerability Alert

What is CVE-2025-69197?

The Pterodactyl Panel, an open-source game server management solution, has a vulnerability where Time-Based One-Time Password (TOTP) tokens can be reused within their valid time frame. This occurs because used tokens are not properly marked as invalid post-authentication, enabling an attacker who intercepts a valid token to exploit this flaw. By using the intercepted token alongside a known username and password during the 60-second validity window, an unauthorized user can gain access to the account. This critical issue was addressed and resolved in version 1.12.0.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch