GHSA-xvc3-826v-xf47: Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)
Summary
Pterodactyl, a server management panel, has a vulnerability in its rate limiting (throttling, or slowing down repeated requests) for login and two-factor authentication endpoints. Instead of limiting attempts per user or IP address, the system uses a single shared counter for all users on all IPs. An attacker can send about 10 requests per minute from one IP to exhaust this shared counter and lock out every user from logging in or completing 2FA verification, causing a denial of service (DoS, making the service unavailable) that persists as long as the attacker continues the attack.
Solution / Mitigation
The source suggests keying the fall-through rate limit by request source: `return Limit::perMinute(10)->by($request->ip());`. Ideally, combine the IP with the submitted login identifier: `->by($request->ip() . '|' . (string) $request->input('user'))`.
Vulnerability Details
EPSS: 0.0%
Yes
July 28, 2026
Classification
Affected Packages
Original source: https://github.com/advisories/GHSA-xvc3-826v-xf47
First tracked: July 28, 2026 at 02:01 PM
Classified by LLM (prompt v3) · confidence: 95%