CVE-2019-1020002
Pterodactyl vulnerable to 2FA Sniffing
Pterodactyl before 0.7.14 with 2FA allows credential sniffing.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Pterodactyl before 0.7.14 with 2FA allows credential sniffing.
- Record
CVE-2019-1020002- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
CVE List No score
Pterodactyl before 0.7.14 with 2FA allows credential sniffing.
- Record
CVE-2019-1020002- Updated
- 2026-11-02
EUVDEUVD-2022-3772 No score
Pterodactyl before 0.7.14 with 2FA allows credential sniffing.
- Record
EUVD-2022-3772- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fg52-xjfc-9rh8
Pterodactyl vulnerable to 2FA Sniffing
Pterodactyl version 0.7.13 and lower - 2FA Sniffing
Users who have enabled 2FA protections on their account can unintentionally have their account's existence sniffed by malicious users who enter random credentials into the login fields.
Impact
Users who have enabled 2FA protections on their account can unintentionally have their account's existence sniffed by malicious users who enter random credentials into the login fields.
A logical mistake was made when the original code was written that would wait to verify the user's password until they had provided 2FA credentials if it was enabled on their account. However, because of this you could enter a bad password for a known email and determine if the account exists if you got redirected to a 2FA page.
For more information
If you have any questions or comments about this advisory please react out on Discord or email dane@[project name].io.
- Record
GHSA-fg52-xjfc-9rh8- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
OSV
Pterodactyl before 0.7.14 with 2FA allows credential sniffing.
- Record
CVE-2019-1020002- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-fg52-xjfc-9rh8
Pterodactyl vulnerable to 2FA Sniffing
Pterodactyl version 0.7.13 and lower - 2FA Sniffing
Users who have enabled 2FA protections on their account can unintentionally have their account's existence sniffed by malicious users who enter random credentials into the login fields.
Impact
Users who have enabled 2FA protections on their account can unintentionally have their account's existence sniffed by malicious users who enter random credentials into the login fields.
A logical mistake was made when the original code was written that would wait to verify the user's password until they had provided 2FA credentials if it was enabled on their account. However, because of this you could enter a bad password for a known email and determine if the account exists if you got redirected to a 2FA page.
For more information
If you have any questions or comments about this advisory please react out on Discord or email dane@[project name].io.
- Record
GHSA-fg52-xjfc-9rh8- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pterodactyl/panelPackagist |
through 0.7.13 | 0.7.14 |
pterodactyl/panelPackagist |
before 0.7.14, plus listed versions v0.1.0-betav0.1.1-betav0.1.2-betav0.2.0-betav0.3.0-beta Show 41 moreShow lessv0.4.0-betav0.4.1-betav0.5.0v0.5.0-rc.1v0.5.0-rc.2v0.5.1v0.5.2v0.5.3v0.5.4v0.5.5v0.5.6v0.5.7v0.6.0v0.6.0-beta.1v0.6.0-beta.2v0.6.0-beta.2.1v0.6.0-rc.1v0.6.1v0.6.2v0.6.3v0.6.4v0.7.0v0.7.0-beta.1v0.7.0-beta.2v0.7.0-beta.3v0.7.0-beta.4v0.7.0-rc.1v0.7.0-rc.2v0.7.1v0.7.10v0.7.11v0.7.12v0.7.13v0.7.2v0.7.3v0.7.4v0.7.5v0.7.6v0.7.7v0.7.8v0.7.9 |
0.7.14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-1020002 is a high vulnerability (CVSS 7.5) in Pterodactyl Panel, published July 29, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.47%, the 73rd percentile. Fixed in pterodactyl/panel 0.7.14.
References
github.com/pterodactyl/panel/security/advisories/GHSA-vcm9-hx3q-qwj8
nvd.nist.gov/vuln/detail/CVE-2019-1020002