Authentication Denial of Service Vulnerability in Pterodactyl Game Server Management Panel
CVE-2026-61609

7.5HIGH

Key Information:

Vendor: Pterodactyl
Status: Panel
Vendor: CVE Published:; 28 July 2026

🔔 Create Pterodactyl Vulnerability Alert

What is CVE-2026-61609?

A vulnerability in Pterodactyl's authentication rate limiter allows unauthenticated attackers to trigger a denial of service on the login and two-factor authentication endpoints. This issue affects versions from 1.7.0 up to 1.12.9, where the rate limiter applies a single global bucket for requests, unable to differentiate between users. Attackers can exploit this by sending excessive requests from one IP address, causing legitimate users, including administrators, to experience login failures and HTTP 429 errors. The problem is resolved in version 1.13.0.