CVE-2025-49132 Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it...

Authentication Bypass

pterodactyl/panel is vulnerable to authentication bypass. The library does not properly verify the user-provided security token, allowing an attacker to bypass the two-factor authentication...