CVE-2025-68954: 
PHP vulnerability analysis and mitigation

CVE-2025-68954 is an Insufficient Session Expiration vulnerability in Pterodactyl, a free open-source game server management panel. Versions 1.11.11 and below of both pterodactyl/panel (Composer) and pterodactyl/wings (Go) fail to revoke active SFTP connections when a user is removed from a server instance or has their file access permissions reduced. The vulnerability was disclosed on January 6, 2026, and fixed in version 1.12.0 of both components. It carries a CVSS v3.1 base score of 5.4 (Medium) per NVD and a CVSS v4.0 base score of 7.5 (High) per the CNA (GitHub) (GitHub Advisory, Feedly).

The root cause is CWE-613 (Insufficient Session Expiration): when a user opens an SFTP connection to a server via the Wings daemon, credentials and permissions are validated only during the initial authentication handshake and are never re-checked for the duration of the session. Consequently, if an administrator removes a subuser or reduces their file-access permissions in the Panel, the already-established SFTP session in Wings continues uninterrupted with the original permissions. The fix introduced a new DaemonRevocationRepository::deauthorize() method that actively calls a /api/deauthorize-user endpoint on the Wings instance to terminate the session, replacing the previously incomplete revokeUserJTI mechanism (GitHub Advisory, Patch Commit). Exploitation requires that the attacker already have an active SFTP connection at the moment their permissions are revoked; users who are not connected at that time cannot reconnect after revocation.

A user whose SFTP access has been administratively revoked can continue to read, modify, or delete files within the affected game server's local filesystem for as long as their SFTP session remains open. The scope is limited to the server's local filesystem — there is no exposure of Wings private data or data outside the server's directory. This could allow unauthorized access to game server configuration files, player data, or other sensitive server-side content, and could enable tampering with server files to disrupt game server integrity (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a specific timing condition — the attacker must already be connected via SFTP at the exact moment their permissions are revoked — which significantly limits practical exploitability.

1. Gain initial SFTP access: The attacker must be a legitimate subuser on a Pterodactyl server instance (versions ≤ 1.11.11) with file access permissions, and establish an active SFTP connection to the Wings daemon using valid credentials.
2. Maintain the SFTP session: Keep the SFTP connection open continuously, using any standard SFTP client (e.g., FileZilla, WinSCP, sftp CLI).
3. Wait for permission revocation: An administrator removes the attacker as a subuser or reduces their file-access permissions via the Pterodactyl Panel UI or API.
4. Continue unauthorized access: Because Wings does not re-validate permissions after the initial handshake, the attacker's existing SFTP session remains active. The attacker can continue to browse, read, upload, modify, or delete files within the server's filesystem despite having no current authorization to do so (GitHub Advisory).

• Network: Persistent SFTP connections (typically TCP port 2022 for Wings) from a user whose account has been removed or had permissions reduced; long-duration SFTP sessions that outlast expected usage patterns.
• Logs: Wings daemon logs showing continued SFTP file operations (reads, writes, deletes) from a user UUID after that user's subuser record has been deleted or modified in the Panel database; Panel audit logs showing a subuser deletion or permission change followed by continued Wings SFTP activity from the same user.
• Process/Session: Active SFTP sessions in Wings that correspond to user UUIDs no longer present in the Panel's subuser table for the given server.

Upgrade both pterodactyl/panel and pterodactyl/wings to version 1.12.0 or later, which introduces active session revocation via the new DaemonRevocationRepository::deauthorize() mechanism (GitHub Release, Patch Commit). As an interim workaround for administrators unable to upgrade immediately, manually restart the Wings daemon after revoking a user's permissions, which will terminate all active SFTP sessions. Additionally, monitor active SFTP sessions and review Wings logs for file activity from recently revoked users.

The vulnerability was reported by a researcher credited as real2two and published by Pterodactyl maintainer DaneEveritt via GitHub Security Advisories on January 6, 2026 (GitHub Advisory). No significant broader media coverage or notable community commentary beyond the standard advisory publication has been identified.