CVE-2025-69197

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-69197", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-12-29T14:34:46.743Z", "datePublished": "2026-01-06T00:44:23.399Z", "dateUpdated": "2026-01-06T19:01:05.967Z"}, "containers": {"cna": {"title": "Pterodactyl TOTPs can be reused during validity window", "problemTypes": [{"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-294", "lang": "en", "description": "CWE-294: Authentication Bypass by Capture-replay", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/pterodactyl/panel/security/advisories/GHSA-rgmp-4873-r683", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-rgmp-4873-r683"}, {"name": "https://github.com/pterodactyl/panel/commit/032bf076d92bb2f929fa69c1bac1b89f26b8badf", "tags": ["x_refsource_MISC"], "url": "https://github.com/pterodactyl/panel/commit/032bf076d92bb2f929fa69c1bac1b89f26b8badf"}, {"name": "https://github.com/pterodactyl/panel/releases/tag/v1.12.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/pterodactyl/panel/releases/tag/v1.12.0"}], "affected": [{"vendor": "pterodactyl", "product": "panel", "versions": [{"version": "< 1.12.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-06T00:44:23.399Z"}, "descriptions": [{"lang": "en", "value": "Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficiently marked as used in the system. This allows an attacker who intercepts that token to use it in addition to a known username/password during the 60-second token validity window. The attacker must have intercepted a valid 2FA token (for example, during a screen share). This issue is fixed in version 1.12.0."}], "source": {"advisory": "GHSA-rgmp-4873-r683", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-06T14:23:37.368932Z", "id": "CVE-2025-69197", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T19:01:05.967Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-69197", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-06T14:23:37.368932Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-06T14:23:39.485Z"}}], "cna": {"title": "Pterodactyl TOTPs can be reused during validity window", "source": {"advisory": "GHSA-rgmp-4873-r683", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "pterodactyl", "product": "panel", "versions": [{"status": "affected", "version": "< 1.12.0"}]}], "references": [{"url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-rgmp-4873-r683", "name": "https://github.com/pterodactyl/panel/security/advisories/GHSA-rgmp-4873-r683", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pterodactyl/panel/commit/032bf076d92bb2f929fa69c1bac1b89f26b8badf", "name": "https://github.com/pterodactyl/panel/commit/032bf076d92bb2f929fa69c1bac1b89f26b8badf", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pterodactyl/panel/releases/tag/v1.12.0", "name": "https://github.com/pterodactyl/panel/releases/tag/v1.12.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficiently marked as used in the system. This allows an attacker who intercepts that token to use it in addition to a known username/password during the 60-second token validity window. The attacker must have intercepted a valid 2FA token (for example, during a screen share). This issue is fixed in version 1.12.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-294", "description": "CWE-294: Authentication Bypass by Capture-replay"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-06T00:44:23.399Z"}}}, "cveMetadata": {"cveId": "CVE-2025-69197", "state": "PUBLISHED", "dateUpdated": "2026-01-06T19:01:05.967Z", "dateReserved": "2025-12-29T14:34:46.743Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-06T00:44:23.399Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "panel", "vendor": "pterodactyl", "versions": [{"status": "affected", "version": "< 1.12.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pterodactyl:panel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6163FD74-C4E9-4B5C-82B5-9BB139F9FE9D", "versionEndExcluding": "1.12.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Users with 2FA enabled are prompted to enter a token during sign-in, and afterward it is not sufficiently marked as used in the system. This allows an attacker who intercepts that token to use it in addition to a known username/password during the 60-second token validity window. The attacker must have intercepted a valid 2FA token (for example, during a screen share). This issue is fixed in version 1.12.0."}, {"lang": "es", "value": "Pterodactyl es un panel de gesti\u00f3n de servidores de juegos gratuito y de c\u00f3digo abierto. Las versiones 1.11.11 e inferiores permiten que el TOTP se utilice varias veces durante su ventana de validez. A los usuarios con 2FA habilitado se les solicita que ingresen un token durante el inicio de sesi\u00f3n, y despu\u00e9s no se marca suficientemente como usado en el sistema. Esto permite a un atacante que intercepta ese token usarlo adem\u00e1s de un nombre de usuario/contrase\u00f1a conocido durante la ventana de validez del token de 60 segundos. El atacante debe haber interceptado un token 2FA v\u00e1lido (por ejemplo, durante una pantalla compartida). Este problema est\u00e1 solucionado en la versi\u00f3n 1.12.0."}], "id": "CVE-2025-69197", "lastModified": "2026-10-07T10:10:00.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-69197", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-06T14:23:37.368932Z", "version": "2.0.3"}}]}, "published": "2026-01-06T01:16:01.537", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/pterodactyl/panel/commit/032bf076d92bb2f929fa69c1bac1b89f26b8badf"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/pterodactyl/panel/releases/tag/v1.12.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-rgmp-4873-r683"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-294"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2026-01-06T14:16:19.108381+00:00", "updated": "2026-01-06T14:16:19.108412+00:00", "vendors": ["pterodactyl", "pterodactyl$PRODUCT$panel"]}