CVE-2026-61609

Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the...

EUVD-2026-49882

Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the...

CVE-2026-61609 Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the...

CVE-2026-61609

Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the...

CVE-2026-61609

Summary: CVE-2026-61609 affects the Pterodactyl panel (versions 1.7.0–1.13.0). The authentication rate limiter in RouteServiceProvider::configureRateLimiting() applied a single global bucket to the login and two‑factor checkpoint endpoints instead of per‑IP or per‑account keys. This caused a shar...

CVE-2026-61609 Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the...

CVE-2026-61609 Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the...

GHSA-XVC3-826V-XF47 Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

Summary The authentication rate limiter used for the login and two-factor checkpoint endpoints applies a single global bucket shared by every client, instead of keying per IP or per account. An unauthenticated attacker sending 10 requests per minute from one IP exhausts the shared bucket and caus...

Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

Summary The authentication rate limiter used for the login and two-factor checkpoint endpoints applies a single global bucket shared by every client, instead of keying per IP or per account. An unauthenticated attacker sending 10 requests per minute from one IP exhausts the shared bucket and caus...

Missing Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization through the generic identity-provider creation and update paths in...

Malicious code in korvica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 065729796ad9ceb2c9939587ce1f61b78bdf36fc13807ace7e2383c22f5e61ba On import, a top-level async IIFE in index.mjs gates on process.platform === 'linux' and NODEENV!== 'production', checks for a WSL host mount at...

MAL-2026-11150 Malicious code in streak-daily-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8664341251bd6864f5aaf9692c5b7bd0945125853bc304c91709aaa335be38f1 On import of index.mjs, setImmediate invokes a syncWorkspace routine whose network destination and paths are reconstructed at runtime from hex-encode...

MagnusBilling - Login Panel Detection

Identified an exposed MagnusBilling login panel. !/usr/bin/env python3 -- coding: utf-8 -- """Identified an exposed MagnusBilling login panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'MagnusBilling - Login Pan...

CrushFTP WebInterface Panel - Detect

CrushFTP WebInterface login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """CrushFTP WebInterface login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CrushFTP WebInterface Panel...

aaPanel Detection

Detects aaPanel Linux management panel login interface. !/usr/bin/env python3 -- coding: utf-8 -- """Detect aaPanel Linux management panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "aaPanel Detection",...

AceNet AceReporter Report Panel - Detect

Detects AceNet AceReporter Report Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects AceNet AceReporter Report Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AceNet AceReporter Repo...

Adobe Media Server Login Panel Detection

An Adobe Media Server login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """An Adobe Media Server login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe Media Server Login...

airCube Dashboard Login Panel - Detect

airCube Dashboard login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """airCube Dashboard login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'airCube Dashboard Login Panel -...

Algonomia Leaf Platform Panel - Detect

Algonomia Leaf Platform login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Algonomia Leaf Platform login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Algonomia Leaf Platform...

Ametys Admin Login Panel Detection

An Ametys admin login panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """An Ametys admin login panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Ametys Admin Login Panel Detection'...