CVE-2025-69198: 
PHP vulnerability analysis and mitigation

CVE-2025-69198 is a race condition vulnerability in Pterodactyl Panel, a free open-source game server management platform, that allows authenticated users to bypass per-server resource limits by sending a high volume of concurrent requests. The flaw affects all versions of pterodactyl/panel prior to 1.12.0 and was disclosed on January 19, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.0 (Medium) (GitHub Advisory, Pterodactyl Advisory).

The root cause is improper resource locking during request processing, classified under CWE-362 (Race Condition), CWE-400 (Uncontrolled Resource Consumption), CWE-413 (Improper Resource Locking), and CWE-667 (Improper Locking). Resource limit validation occurs early in the request cycle without acquiring a database-level lock on the target resource (e.g., lockForUpdate()), meaning multiple concurrent requests each independently pass the limit check before any resource is actually created. An attacker with low-privilege authenticated access can exploit this over the network by flooding the API endpoints for database creation (POST /databases), network allocation (POST /network/allocations), or backup creation (POST /backups) with simultaneous requests, causing all of them to succeed and exceed configured limits (GitHub Advisory, Patch Commit).

Successful exploitation is availability-focused: an authenticated attacker can create more databases, port allocations, or backups than the server's configured limits allow, effectively denying those shared resources to other legitimate users on the same node. The attacker can exhaust node-wide port allocations, preventing other servers from obtaining new allocations, or rapidly fill backup storage beyond configured quotas. There is no confidentiality or integrity impact — the vulnerability does not expose data or allow unauthorized modification of existing resources (GitHub Advisory, Pterodactyl Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038–0.063%, placing it in the lower percentiles for near-term exploitation likelihood. Exploitation requires a valid low-privilege account on the target Pterodactyl Panel instance, limiting the attacker pool to existing users (GitHub Advisory).

1. Obtain credentials: Acquire a low-privilege user account on the target Pterodactyl Panel instance (e.g., via a free trial, social engineering, or credential reuse).
2. Identify target server: Locate a server managed by the panel that has resource limits configured for databases, port allocations, or backups.
3. Craft concurrent requests: Using a tool such as curl with parallel execution, Python's asyncio/aiohttp, or a load-testing tool like wrk or ab, prepare a large batch of identical API POST requests targeting a resource creation endpoint (e.g., POST /api/client/servers/{server_uuid}/databases).
4. Fire simultaneous requests: Send all requests at the same time so they arrive at the server concurrently. Because validation occurs before any lock is acquired, each request independently reads the current resource count (below the limit) and proceeds to create the resource.
5. Verify over-provisioning: Confirm that more resources than the configured limit now exist on the server (e.g., more databases, allocations, or backups than allowed), demonstrating successful bypass of the rate limit.
6. Sustain denial of service: Repeat the process to exhaust node-wide allocations or fill backup storage, preventing other users from creating resources (GitHub Advisory, Patch Commit).

• Network: Sudden spike in concurrent POST requests to /api/client/servers/{uuid}/databases, /api/client/servers/{uuid}/network/allocations, or /api/client/servers/{uuid}/backups from a single authenticated user or IP address within a very short time window.
• Logs: Application access logs showing dozens or hundreds of identical resource-creation API calls from the same session token within milliseconds; activity log entries (server:database.create, server:allocation.create, server:backup.start) far exceeding the configured per-server resource limits.
• Application State: Database, allocation, or backup counts for a specific server exceeding the configured maximum values in the Pterodactyl admin panel; node allocation pools showing unexpected exhaustion.

Upgrade Pterodactyl Panel to version 1.12.0 or later, which resolves the vulnerability by wrapping resource creation in database transactions with lockForUpdate() calls and adding per-resource throttle middleware to the relevant API routes (Patch Commit, GitHub Advisory). As a defense-in-depth measure while planning the upgrade, administrators can implement additional rate limiting at the reverse proxy or infrastructure level (e.g., nginx limit_req) on the resource creation endpoints, and restrict panel access to only trusted users. Monitoring concurrent API request rates per user can also help detect and block abuse attempts.

The advisory was published by Pterodactyl maintainer anthonyphysgun on January 19, 2026, with credit to reporters vsevolodmelnyk and hymaxo (Pterodactyl Advisory). A brief technical write-up was published by Infinit Security shortly after disclosure (Infinit Security). No significant broader media coverage or notable social media discussion has been identified for this vulnerability.