Pterodactyl vulnerable to 2FA Sniffing
Pterodactyl version 0.7.13 and lower - 2FA Sniffing
Users who have enabled 2FA protections on their account can unintentionally have their account's existence sniffed by malicious users who enter random credentials into the login fields.
Impact
Users who have enabled 2FA protections on their account can unintentionally have their account's existence sniffed by malicious users who enter random credentials into the login fields.
A logical mistake was made when the original code was written that would wait to verify the user's password until they had provided 2FA credentials if it was enabled on their account. However, because of this you could enter a bad password for a known email and determine if the account exists if you got redirected to a 2FA page.
For more information
If you have any questions or comments about this advisory please react out on Discord or email dane@[project name].io.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | pterodactyl/panel | < 0.7.14 | 0.7.14 |
References
- https://github.com/pterodactyl/panel/security/advisories/GHSA-vcm9-hx3q-qwj8
- https://nvd.nist.gov/vuln/detail/CVE-2019-1020002
- https://github.com/pterodactyl/panel/commit/092e7e79fff858ee026608c7dbccab165a67526f
- https://github.com/pterodactyl/panel
- https://github.com/pterodactyl/panel/releases/tag/v0.7.14
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-203- Platform
- Composer
- Package
pterodactyl/panel- Disclosed
- 24.05.2022
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-fg52-xjfc-9rh8 - CC BY 4.0
Vulnerability history: pterodactyl/panel
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 19
- First → latest
- 10.2020 07.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 6
- Medium 8
- Low 3
Disclosures per year
- 2020: 1
- 2021: 3
- 2022: 2
- 2023: 0
- 2024: 2
- 2025: 2
- 2026: 9
-
Pterodactyl vulnerable to 2FA Sniffing this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.