CVE-2026-61609
Received Received - Intake

Rate Limiting Bypass in Pterodactyl Panel

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description
Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting() applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the fall-through Limit::perMinute(10) covering POST /auth/login and POST /auth/login/checkpoint omitted ->by(), so Laravel derived a constant cache key (md5('authentication')) shared by every request. An unauthenticated attacker sending roughly ten requests per minute from a single IP, most cheaply against the checkpoint endpoint (which has no reCAPTCHA), exhausts the shared counter and causes HTTP 429 for every user attempting to log in or complete two-factor authentication, a panel-wide authentication denial of service that also locks out administrators. This issue is fixed in version 1.13.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-61609
EUVD
EUVD-2026-49882

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
pterodactyl pterodactyl From 1.7.0 (inc) to 1.13.0 (inc)
pterodactyl panel From 1.7.0 (inc) to 1.12.4 (inc)
pterodactyl panel 1.13.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-61609 is a rate-limiting flaw in Pterodactyl Panel versions 1.7.0 to 1.13.0. The login and two-factor authentication endpoints used a single global rate limit instead of per-IP limits. Attackers could send 10 requests per minute to exhaust this shared limit, causing HTTP 429 errors for all users and locking them out.

Detection Guidance

Monitor HTTP 429 responses from Pterodactyl login or 2FA endpoints. Check for repeated requests from single IPs exceeding 10 per minute to /auth/login or /auth/login/checkpoint. Use tools like curl to test rate limits: curl -X POST -d '[email protected]&password=pass' http://pterodactyl-panel/auth/login. Inspect server logs for repeated failed login attempts or 429 errors.

Impact Analysis

This vulnerability allows unauthenticated attackers to cause a denial of service by blocking all login and two-factor authentication attempts. Legitimate users, including administrators, cannot access the panel, disrupting server management operations.

Compliance Impact

This vulnerability causes a denial of service by locking out all users from the Pterodactyl Panel, including administrators, due to a shared global rate limiter. This could disrupt access to critical systems, potentially violating availability requirements in GDPR and HIPAA, which mandate timely access to personal and health data.

Mitigation Strategies

Upgrade Pterodactyl Panel to version 1.13.0 or later to apply IP-based rate limiting. If upgrading is not immediately possible, manually patch the rate limiter in RouteServiceProvider.php to enforce per-IP limits for login and 2FA endpoints. Temporarily block suspicious IPs generating excessive requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61609. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart