Pterodactyl’s authentication rate limiter incorrectly used a single global bucket for the login and two‑factor checkpoint routes. This shared counter, keyed only by a literal string, was depleted by an attacker submitting roughly ten requests per minute to the checkpoint endpoint. Once exhausted, the limiter returned HTTP 429 for all subsequent login and 2FA attempts, effectively blocking every user from accessing the panel, including administrators. The weakness is a resource‑allocation flaw (CWE‑770). The impact is a chain‑wide authentication denial of service that can render the entire panel inaccessible without compromising credentials or permissions.

Vendors: Pterodactyl. Products: Pterodactyl Panel, versions 1.7.0 through 1.13.0. The issue was fixed in version 1.13.0, so installations of any earlier releases are vulnerable.

The vulnerability has a CVSS score of 7.5, indicating a high‑severity DoS risk. The EPSS score is below 1 %, suggesting that exploitation is unlikely but still plausible. It is not listed in CISA KEV, so there are no known active exploits reported. The attack vector is remote network access to the panel’s public login and authentication endpoints; an attacker only needs to send traffic from a single IP address, making it relatively straightforward to trigger the rate limit. Once triggered, the lockout persists until the rate limiter is reset or the panel is restarted. Administrators are especially at risk because they may be unable to log in to remediate the issue.