CVE Explorer
CVE-2026-61609
Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting() applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the fall-through Limit::perMinute(10) covering POST /auth/login and POST /auth/login/checkpoint omitted ->by(), so Laravel derived a constant cache key (md5('authentication')) shared by every request. An u
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"panel","vendor":"pterodactyl","versions":[{"status":"affected","version":">= 1.7.0, < 1.13.0"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:1f9016f72e53dfb2a044bb987beb92378663e6281bd7b9adc04537ac21f47826 · sha256:9e8b34e48a3cfaf9… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:1f9016f72e53dfb2a044bb987beb92378663e6281bd7b9adc04537ac21f47826 · sha256:9e8b34e48a3cfaf9… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-770","description":"CWE-770: Allocation of Resources Without Limits or Throttling","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:1f9016f72e53dfb2a044bb987beb92378663e6281bd7b9adc04537ac21f47826 · sha256:9e8b34e48a3cfaf9… · /containers/cna/problemTypes/0/descriptions/0
Source references
4 source assertions{"name":"https://github.com/pterodactyl/panel/commit/98079a01660a61980fe62a72b2c1d48f99c35a5e","tags":["x_refsource_MISC"],"url":"https://github.com/pterodactyl/panel/commit/98079a01660a61980fe62a72b2c1d48f99c35a5e"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:1f9016f72e53dfb2a044bb987beb92378663e6281bd7b9adc04537ac21f47826 · sha256:9e8b34e48a3cfaf9… · /containers/cna/references/1
{"name":"https://github.com/pterodactyl/panel/releases/tag/v1.13.0","tags":["x_refsource_MISC"],"url":"https://github.com/pterodactyl/panel/releases/tag/v1.13.0"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:1f9016f72e53dfb2a044bb987beb92378663e6281bd7b9adc04537ac21f47826 · sha256:9e8b34e48a3cfaf9… · /containers/cna/references/2
{"name":"https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47","tags":["x_refsource_CONFIRM"],"url":"https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:1f9016f72e53dfb2a044bb987beb92378663e6281bd7b9adc04537ac21f47826 · sha256:9e8b34e48a3cfaf9… · /containers/cna/references/0
{"tags":["exploit"],"url":"https://github.com/pterodactyl/panel/security/advisories/GHSA-xvc3-826v-xf47"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:1f9016f72e53dfb2a044bb987beb92378663e6281bd7b9adc04537ac21f47826 · sha256:9e8b34e48a3cfaf9… · /containers/adp/0/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.