CVE-2025-69197: 
PHP vulnerability analysis and mitigation

CVE-2025-69197 is a TOTP replay/reuse vulnerability in Pterodactyl Panel, a free open-source game server management panel, that allows an attacker to bypass two-factor authentication by reusing an intercepted TOTP token within its validity window. Affected versions are all releases up to and including 1.11.11; the issue is fixed in version 1.12.0. The vulnerability was disclosed on January 6, 2026, by maintainer DaneEveritt via a GitHub Security Advisory. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, NVD).

The root cause is improper authentication (CWE-287) combined with authentication bypass by capture-replay (CWE-294): after a user successfully authenticates with a TOTP token, the panel's LoginCheckpointController called google2FA->verifyKey() without recording the token as consumed, allowing the same token to be accepted again within the ~60-second validity window (two 30-second TOTP periods). The fix, introduced in commit 032bf07, replaces verifyKey() with verifyKeyNewer(), which checks the token's timestamp against a newly added totp_authenticated_at database column; upon successful verification, the current timestamp is stored and subsequent attempts using the same or older token are rejected (GitHub Advisory, Patch Commit). Exploitation requires the attacker to already possess valid credentials (username and password) and to have observed or intercepted a valid TOTP token — for example, via a screen share or network interception — before the 60-second window expires.

Successful exploitation allows an attacker to fully bypass 2FA and gain unauthorized access to a Pterodactyl Panel account, effectively rendering the second authentication factor useless. Once authenticated, the attacker can manage game servers, access sensitive administrative functions, view server configurations, and potentially pivot to underlying infrastructure depending on the account's privilege level. The confidentiality impact is rated High, while integrity and availability are unaffected by the authentication bypass itself (GitHub Advisory, NVD).

1. Credential acquisition: Obtain a valid username and password for a target Pterodactyl Panel account through phishing, credential stuffing, or prior data breach.
2. Token interception: Observe or capture a valid TOTP token from the legitimate user — for example, by monitoring a screen share session, performing a man-in-the-middle attack on an unencrypted connection, or via social engineering.
3. Initiate login: Submit the stolen credentials to the Pterodactyl Panel login endpoint to trigger the 2FA checkpoint.
4. Replay the TOTP token: Within the ~60-second validity window (two 30-second TOTP periods), submit the intercepted TOTP token to the auth.login-checkpoint endpoint (e.g., POST /auth/login/checkpoint with confirmation_token and authentication_code parameters).
5. Gain access: Because the panel does not mark the token as used, the replayed token is accepted and the attacker is authenticated as the target user, gaining full access to the account and its game server management capabilities (GitHub Advisory, Patch Commit).

• Logs: Multiple successful authentication events for the same user account within a short timeframe (within 60 seconds), particularly where the same TOTP token timestamp window is used more than once; look for repeated POST requests to /auth/login/checkpoint with successful responses for the same user.
• Logs: Authentication log entries showing a login from an IP address geographically or behaviorally inconsistent with the legitimate user's normal access patterns immediately following a legitimate login.
• Network: Concurrent or near-simultaneous authenticated sessions for the same user originating from different IP addresses, suggesting token replay from a separate attacker-controlled host.
• Application: Unexpected administrative actions (server creation, deletion, configuration changes) occurring shortly after a login event that may indicate unauthorized access via replayed credentials (GitHub Advisory).

Upgrade Pterodactyl Panel to version 1.12.0 or later, which resolves the vulnerability by tracking TOTP token usage via the totp_authenticated_at column and using verifyKeyNewer() to reject replayed tokens (v1.12.0 Release, Patch Commit). No official configuration-based workaround exists for versions below 1.12.0. As interim measures, administrators should restrict network access to the panel to trusted IP addresses or VPNs, monitor authentication logs for suspicious duplicate login attempts, and advise users to avoid sharing screens while authenticating (GitHub Advisory).