Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-px9v-aj25-qba9
Vulnerability ID VCID-px9v-aj25-qba9
Aliases CVE-2024-49762
GHSA-c479-wq8g-57hr
Summary Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled When a user disables two-factor authentication via the Panel, a `DELETE` request with their current password in a query parameter will be sent. While query parameters are encrypted when using TLS, many webservers (including ones officially documented for use with Pterodactyl) will log query parameters in plain-text, storing a user's password in plain text. If a malicious user obtains access to these logs they could *potentially* authenticate against a user's account; assuming they are able to discover the account's email address or username **separately**.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-313 Cleartext Storage in a File or on Disk
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-49762
cvssv3.1 4.6 https://github.com/pterodactyl/panel
generic_textual MODERATE https://github.com/pterodactyl/panel
cvssv3.1 4.6 https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4
generic_textual MODERATE https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4
ssvc Track https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4
cvssv3.1 4.6 https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1
generic_textual MODERATE https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1
ssvc Track https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1
cvssv3.1 4.6 https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr
generic_textual MODERATE https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr
ssvc Track https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr
cvssv3.1 4.6 https://nvd.nist.gov/vuln/detail/CVE-2024-49762
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-49762
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-49762
https://github.com/pterodactyl/panel
https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4
https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1
CVE-2024-49762 https://nvd.nist.gov/vuln/detail/CVE-2024-49762
GHSA-c479-wq8g-57hr https://github.com/advisories/GHSA-c479-wq8g-57hr
GHSA-c479-wq8g-57hr https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/pterodactyl/panel
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-25T17:20:24Z/ Found at https://github.com/pterodactyl/panel/commit/75b59080e2812ced677dab516222b2a3bb34e3a4
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-25T17:20:24Z/ Found at https://github.com/pterodactyl/panel/commit/8be2b892c3940bdc0157ccdab16685a72d105dd1
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-25T17:20:24Z/ Found at https://github.com/pterodactyl/panel/security/advisories/GHSA-c479-wq8g-57hr
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-49762
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.11231
EPSS Score 0.00036
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:22:26.943270+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/pterodactyl/panel/CVE-2024-49762.yml 38.6.0