7.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-68954

CVE-2025-68954: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-68954

CVE-2025-68954:

7.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pterodactyl/panel	composer	< 1.12.0	1.12.0
github.com/pterodactyl/wings	go	< 1.12.0	1.12.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows a user with an active SFTP connection to a Pterodactyl server to maintain access even after their permissions have been revoked or they have been removed from the server. This is because the application failed to terminate active sessions upon a permission change.

The analysis of the provided patch (commit 2bd9d8baddb0e0606e4a9d5be402f48678ac88d5 in pterodactyl/panel) reveals the flawed logic. The application was using a function called revokeUserJTI, which only invalidated a JSON Web Token (JWT). This action is insufficient for terminating an already established SFTP session, which is stateful.

The patch introduces a new mechanism, a deauthorize method within a new DaemonRevocationRepository. This new method makes a direct API call to the Pterodactyl Wings daemon, instructing it to explicitly terminate the user's active connections (SFTP and websockets).

The vulnerable functions are the ones that were responsible for managing user permissions and called the ineffective revokeUserJTI method. These are:

Pterodactyl\Http\Controllers\Api\Client\Servers\SubuserController::update: Triggered when a subuser's permissions are changed.
Pterodactyl\Http\Controllers\Api\Client\Servers\SubuserController::delete: Triggered when a subuser is removed from a server.
Pterodactyl\Services\Servers\DetailsModificationService::handle: Triggered when server ownership is transferred.

During exploitation, an attacker would have an active SFTP session. An administrator would then perform an action (like deleting the user or changing their permissions) that calls one of these vulnerable functions. Because these functions originally failed to terminate the SFTP session, the attacker's access would persist. The presence of these function names in a runtime profile during such an administrative action would be a strong indicator of this vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.