CRITICAL10.0Packagist
GHSA-24wv-6c99-f843· CVE-2025-49132Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
Modified: 6/20/2025
package
Packagist/pterodactyl/panel
pkg:packagist/pterodactyl/panel
MEDIUM6.1Packagist
GHSA-384w-wffr-x63q· CVE-2024-34067Pterodactyl panel's admin area vulnerable to Cross-site Scripting
Modified: 9/10/2026
MEDIUMPackagist
GHSA-5822-pw57-vv37XSS vulnerability when listing users on add & modify server pages.
Modified: 12/2/2024
HIGH8.1Packagist
GHSA-5vfx-8w6m-h3v4· CVE-2021-41129Pterodactyl Panel vulnerable to authentication bypass due to improper user-provided security token verification
Modified: 7/8/2026
MEDIUM6.0Packagist
GHSA-7v3x-h7r2-34jvInsufficient Session Expiration in Pterodactyl API
Modified: 12/4/2024
MEDIUM4.6Packagist
GHSA-c479-wq8g-57hr· CVE-2024-49762Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled
Modified: 10/25/2024
HIGH7.5Packagist
GHSA-fg52-xjfc-9rh8· CVE-2019-1020002, GHSA-vcm9-hx3q-qwj8Pterodactyl vulnerable to 2FA Sniffing
Modified: 9/10/2026
LOWPackagist
GHSA-fgmm-w5cx-vrfw· CVE-2026-35202Pterodactyl has a database resource limit bypass via race condition in Client API
Modified: 9/10/2026
CRITICALPackagist
GHSA-g7vw-f8p5-c728· CVE-2026-26016Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization
Modified: 2/19/2026
MEDIUMPackagist
GHSA-j7f5-gfqm-pcx3Pterodactyl Panel: Client email change endpoint allows enumeration of accounts in system
Modified: 9/10/2026
MEDIUM6.5Packagist
GHSA-jw2v-cq5x-q68g· CVE-2025-69198Pterodactyl improperly locks resources allowing raced queries to create more resources than alloted
Modified: 2/3/2026
—0.0Packagist
GHSA-m49f-hcxp-6hm6· CVE-2021-41176pterodactyl/panel CSRF allowing an external page to trigger a user logout event
Modified: 7/8/2026
LOWPackagist
GHSA-mgr9-6c2j-jxrqPterodactyl has a Reflected XSS vulnerability in “Create New Database Host”
Modified: 12/30/2025
MEDIUM6.5Packagist
GHSA-rgmp-4873-r683· CVE-2025-69197Pterodactyl TOTPs can be reused during validity window
Modified: 2/3/2026
MEDIUM4.3Packagist
GHSA-wwgq-9jhf-qgw6· CVE-2021-41273Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys
Modified: 7/8/2026
HIGH7.5Packagist
GHSA-xvc3-826v-xf47· CVE-2026-61609Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)
Modified: 7/28/2026
HIGHPackagistGo
GHSA-8c39-xppg-479c· CVE-2025-68954, GO-2026-4283Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced
Modified: 2/3/2026
HIGH8.1PackagistGo
GHSA-8r6w-3qq5-4p4r· CVE-2026-54593, GO-2026-6120Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
Modified: 8/18/2026
HIGHPackagistGo
GHSA-hr7j-63v7-vj7g· GO-2026-4497Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change
Modified: 2/23/2026