Insufficient Session Expiration
CVE-2025-68954
Summary
Pterodactyl is a free, open-source game server management panel. Versions prior to 1.12.0 do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.
- LOW
- NETWORK
- LOW
- UNCHANGED
- NONE
- LOW
- LOW
- NONE
CWE-613 - Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Advisory Timeline
- Published
