CVE-2026-61609: Pterodactyl Panel DoS Vulnerability

CVE-2026-61609 Overview

CVE-2026-61609 is a denial of service vulnerability in Pterodactyl, an open-source game server management panel. The flaw exists in the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting(). Versions from 1.7.0 up to (but not including) 1.13.0 apply a single global rate limit bucket to the login and two-factor checkpoint endpoints. An unauthenticated attacker sending roughly ten requests per minute from a single IP can exhaust the shared counter. This produces HTTP 429 responses for every user attempting to authenticate, locking out administrators and regular users alike. The vulnerability is tracked as [CWE-770] Allocation of Resources Without Limits or Throttling.

Critical Impact
A single low-bandwidth attacker can trigger a panel-wide authentication denial of service, locking out all users including administrators from the Pterodactyl web interface.

Affected Products

Pterodactyl Panel version 1.7.0
Pterodactyl Panel versions 1.7.0 through 1.12.x
Fixed in Pterodactyl Panel version 1.13.0

Discovery Timeline

2026-07-28 - CVE-2026-61609 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-61609

Vulnerability Analysis

The vulnerability resides in the Laravel rate limiter configuration inside app/Providers/RouteServiceProvider.php. The configureRateLimiting() method defines throttles for authentication endpoints. The fall-through branch returns Limit::perMinute(10) without calling ->by() to key the limiter on request attributes. Laravel then derives a constant cache key computed as md5('authentication'), which every request shares.

The shared counter covers both POST /auth/login and POST /auth/login/checkpoint. The checkpoint endpoint handles two-factor authentication and does not require reCAPTCHA validation. This makes it the cheapest target for exhausting the global bucket. Once the counter reaches ten requests within a minute, the panel returns HTTP 429 Too Many Requests to all subsequent authentication attempts.

Root Cause

The root cause is a missing ->by() call on the Laravel Limit builder. Without an identifier such as $request->ip() or an account attribute, Laravel falls back to a single global cache key. Rate limiting intended to protect against brute-force attacks instead creates a shared resource that any unauthenticated caller can exhaust.

Attack Vector

The attack requires only network access to the Pterodactyl panel. No authentication, user interaction, or elevated privileges are needed. An attacker sends a sustained low-volume flood of POST requests to /auth/login/checkpoint. Ten requests per minute is sufficient to keep the shared counter saturated. Legitimate users, including administrators, then receive 429 responses and cannot log in.

php

// Vulnerable code in app/Providers/RouteServiceProvider.php
                 return Limit::perMinute(2)->by($request->ip());
             }
 
-            return Limit::perMinute(10);
+            return Limit::perMinute(10)->by($request->ip());
         });
 
         // Configure the throttles for both the application and client APIs below.

Source: GitHub Commit 98079a0. The patch adds ->by($request->ip()) so the limiter tracks requests per source IP instead of a shared global bucket.

Detection Methods for CVE-2026-61609

Indicators of Compromise

Sustained volume of POST /auth/login/checkpoint requests from a single source IP at or above ten per minute.
HTTP 429 responses returned to legitimate users on /auth/login and /auth/login/checkpoint endpoints.
Reports from administrators unable to authenticate to the Pterodactyl panel despite valid credentials.

Detection Strategies

Monitor web server and reverse proxy logs for request rates to authentication endpoints and correlate spikes with 429 response codes.
Alert on any source IP issuing more than five requests per minute to /auth/login/checkpoint on unpatched panels.
Track authentication failure telemetry and pair it with panel-wide login availability probes to detect lockout conditions.

Monitoring Recommendations

Ingest Pterodactyl panel access logs into a centralized logging system for authentication endpoint analysis.
Configure synthetic checks that periodically attempt a benign authentication flow and alert on unexpected 429 responses.
Track request-per-minute baselines for /auth/login and /auth/login/checkpoint and alert on deviations.

How to Mitigate CVE-2026-61609

Immediate Actions Required

Upgrade Pterodactyl Panel to version 1.13.0 or later, which applies per-IP keying to the authentication rate limiter.
Place the panel behind a reverse proxy or web application firewall that can enforce per-IP rate limits independently of the application.
Restrict administrative access to the panel via IP allowlisting where feasible, ensuring administrators can authenticate even if the shared limiter is exhausted.

Patch Information

The fix is available in Pterodactyl Panel v1.13.0. The patch modifies RouteServiceProvider::configureRateLimiting() to call ->by($request->ip()) on the fall-through Limit::perMinute(10) return, ensuring rate limits are tracked per source IP. See the GitHub Security Advisory GHSA-xvc3-826v-xf47 for the official disclosure and the remediation commit for the exact code change.

Workarounds

Manually patch app/Providers/RouteServiceProvider.php to add ->by($request->ip()) to the affected Limit::perMinute(10) call if immediate upgrade is not possible.
Deploy an upstream rate limiter (Nginx limit_req, Cloudflare, or equivalent) targeting the authentication endpoints with per-IP thresholds.
Temporarily block traffic from suspicious IPs generating repeated POSTs to /auth/login/checkpoint at the network edge.

bash

# Nginx per-IP rate limit example for Pterodactyl authentication endpoints
http {
    limit_req_zone $binary_remote_addr zone=pterologin:10m rate=5r/m;

    server {
        location = /auth/login {
            limit_req zone=pterologin burst=5 nodelay;
            proxy_pass http://pterodactyl_upstream;
        }

        location = /auth/login/checkpoint {
            limit_req zone=pterologin burst=5 nodelay;
            proxy_pass http://pterodactyl_upstream;
        }
    }
}