CVE-2026-61609: Panel global rate limiter enables

CISO Take

A shared, unkeyed rate limiter on the login and 2FA checkpoint endpoints means a single unauthenticated attacker sending roughly 10 requests per minute from one IP can lock out every user on every IP, admins included, for as long as the attack is sustained. There is no EPSS score or public exploit/scanner coverage yet and the CVE is not in CISA KEV, but the bug requires no credentials, no user interaction, and only trivial scripting skill (CVSS 7.5, AV:N/AC:L/PR:N/UI:N), so the barrier to exploitation is effectively zero once the advisory is public. With 491 downstream dependents and this being a widely deployed self-hosted game-server management panel, any internet-facing instance is exposed, and the fact that admins are locked out alongside regular users complicates incident response during an active attack. Upgrade to Pterodactyl Panel 1.13.0 immediately; if patching is delayed, front the panel with a reverse-proxy/WAF rate limit keyed per source IP on `/auth/login` and `/auth/login/checkpoint`, and monitor for sustained bursts of 429 responses on those routes as a detection signal.

Sources: NVD GitHub Advisory CISA KEV

What is the risk?

High-severity, network-exploitable availability issue with a trivial trigger (unauthenticated, ~10 req/min, no special tooling). Impact is confidentiality/integrity-neutral but availability-total (A:H) for the authentication surface, which functionally denies service to the entire application since no user can log in. Exploitation likelihood is currently unmeasured (no EPSS score published) and there is no known public exploit code or Nuclei template, but the PoC in the advisory is a five-line curl loop, so weaponization is expected to be immediate once the advisory circulates. Not in CISA KEV. Exposure is high for any panel reachable from the internet, which is the default deployment pattern for Pterodactyl.

How does the attack unfold?

Initial Access

Unauthenticated attacker sends automated POST requests to the reCAPTCHA-free 2FA checkpoint endpoint from a single IP.

Exploitation

Because the fallback rate limiter has no `->by()` key, all ~10 requests exhaust one global counter shared by every client on the panel.

Impact

Every user and admin attempting login or 2FA from any IP receives HTTP 429; repeating the burst each minute sustains a full panel-wide authentication outage.

AML.T0029

Initial Access

Unauthenticated attacker sends automated POST requests to the reCAPTCHA-free 2FA checkpoint endpoint from a single IP.

Exploitation

Because the fallback rate limiter has no `->by()` key, all ~10 requests exhaust one global counter shared by every client on the panel.

Impact

Every user and admin attempting login or 2FA from any IP receives HTTP 429; repeating the burst each minute sustains a full panel-wide authentication outage.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Panel	composer	>= 1.7.0, <= 1.12.4	`1.13.0`
5.7K OpenSSF 6.9 491 dependents Pushed 4d ago 62% patched ~17d to patch Full package profile →

Do you use Panel? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

1 step

1) Upgrade to Pterodactyl Panel 1.13.0 or later, which keys the fall-through rate limiter by $request->ip() (and ideally IP + submitted identifier). 2) If immediate patching isn't possible, add an edge/WAF rate limit per source IP on POST /auth/login and POST /auth/login/checkpoint as a compensating control. 3) Alert on sustained 429 responses from /auth/login* endpoints as an indicator of active exploitation. 4) After patching, verify the forgot-password endpoint behavior is unaffected (it was already correctly IP-scoped) and confirm reCAPTCHA still gates /auth/login as intended.

How is it classified?

DoS Framework AML.T0029 - Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

OWASP LLM Top 10

LLM10 - Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-61609?

A shared, unkeyed rate limiter on the login and 2FA checkpoint endpoints means a single unauthenticated attacker sending roughly 10 requests per minute from one IP can lock out every user on every IP, admins included, for as long as the attack is sustained. There is no EPSS score or public exploit/scanner coverage yet and the CVE is not in CISA KEV, but the bug requires no credentials, no user interaction, and only trivial scripting skill (CVSS 7.5, AV:N/AC:L/PR:N/UI:N), so the barrier to exploitation is effectively zero once the advisory is public. With 491 downstream dependents and this being a widely deployed self-hosted game-server management panel, any internet-facing instance is exposed, and the fact that admins are locked out alongside regular users complicates incident response during an active attack. Upgrade to Pterodactyl Panel 1.13.0 immediately; if patching is delayed, front the panel with a reverse-proxy/WAF rate limit keyed per source IP on `/auth/login` and `/auth/login/checkpoint`, and monitor for sustained bursts of 429 responses on those routes as a detection signal.

Is CVE-2026-61609 actively exploited?

No confirmed active exploitation of CVE-2026-61609 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-61609?

1) Upgrade to Pterodactyl Panel 1.13.0 or later, which keys the fall-through rate limiter by `$request->ip()` (and ideally IP + submitted identifier). 2) If immediate patching isn't possible, add an edge/WAF rate limit per source IP on `POST /auth/login` and `POST /auth/login/checkpoint` as a compensating control. 3) Alert on sustained 429 responses from `/auth/login*` endpoints as an indicator of active exploitation. 4) After patching, verify the forgot-password endpoint behavior is unaffected (it was already correctly IP-scoped) and confirm reCAPTCHA still gates `/auth/login` as intended.

What is the CVSS score for CVE-2026-61609?

CVE-2026-61609 has a CVSS v3.1 base score of 7.5 (HIGH).

What is the AI security impact?

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

Compliance Controls Affected

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting() applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the fall-through Limit::perMinute(10) covering POST /auth/login and POST /auth/login/checkpoint omitted ->by(), so Laravel derived a constant cache key (md5('authentication')) shared by every request. An unauthenticated attacker sending roughly ten requests per minute from a single IP, most cheaply against the checkpoint endpoint (which has no reCAPTCHA), exhausts the shared counter and causes HTTP 429 for every user attempting to log in or complete two-factor authentication, a panel-wide authentication denial of service that also locks out administrators. This issue is fixed in version 1.13.0.

Exploitation Scenario

An attacker with no credentials targets a public-facing Pterodactyl panel used to administer self-hosted AI inference nodes or bot workloads. They script ~10 malformed POST requests per minute to `/auth/login/checkpoint` (which has no reCAPTCHA), exhausting the single global rate-limit bucket shared by every client. Within seconds, all legitimate users — including administrators — receive HTTP 429 on both `/auth/login` and the 2FA checkpoint, regardless of their own source IP or account validity. The attacker repeats the burst once per minute indefinitely, keeping the panel's authentication fully locked out. If the panel manages AI-service infrastructure, this denies operators the ability to respond to any simultaneous incident on those services, compounding the operational impact.

Weaknesses (CWE)

CWE-770 Allocation of Resources Without Limits or Throttling Primary CWE-770 Allocation of Resources Without Limits or Throttling Primary CWE-770 Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.