CVE-2026-54593
Received Received - Intake

JWT Replay Leading to Arbitrary File Write in Pterodactyl

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description
Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server_uuid, user_uuid, and unique_id claims without checking the token's intended purpose; because the Panel issues JWTs carrying those same claims for lower-privilege operations such as WebSocket authentication and file-download links, an authenticated subuser could reuse one of those tokens (for example a WebSocket token obtained with only the websocket.connect permission) by replaying it against /upload/file to write arbitrary files to the same server, despite never being granted the file.create permission. This issue is fixed in Panel version 1.12.3 and Wings version 1.12.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-54593
EUVD
EUVD-2026-49880

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
pterodactyl panel to 1.12.3 (exc)
pterodactyl wings to 1.12.2 (exc)
pterodactyl panel 1.12.3
pterodactyl wings 1.12.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1270 The product implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens generated in the system are incorrect.
CWE-1259 The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54593 is a privilege escalation flaw in Pterodactyl Panel and Wings. It allows authenticated subusers with minimal permissions, such as websocket.connect, to reuse JWT tokens issued for other purposes (like WebSocket authentication) to upload arbitrary files via the /upload/file endpoint. This happens because the Wings endpoint accepted tokens with server_uuid, user_uuid, and unique_id claims without verifying the token's intended scope.

Detection Guidance

Check if your Pterodactyl Panel is running version 1.12.3 or higher and Wings is running version 1.12.2 or higher. Use commands like 'pterodactyl panel:version' and 'pterodactyl wings:version' if available. Inspect network traffic for unauthorized file uploads to the /upload/file endpoint.

Impact Analysis

An attacker with limited access could exploit this to upload malicious files to a server they manage, potentially leading to code execution, data corruption, or denial of service. The vulnerability enables unauthorized file writes despite lacking the required file.create permission, increasing the risk of system compromise.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and data integrity, such as GDPR's principle of least privilege or HIPAA's safeguards for protected health information. Unauthorized file uploads may lead to data breaches or unauthorized modifications, risking regulatory penalties and loss of trust.

Mitigation Strategies

Upgrade Pterodactyl Panel to version 1.12.3 and Wings to version 1.12.2 immediately. Revoke all existing JWT tokens and regenerate them with proper scopes. Monitor for unauthorized file uploads and restrict access to the /upload/file endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54593. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart