https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 14:17:36 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-60694 EUVD-2026-60694 https://cve.radiocsirt.org/vuln/euvd-2026-60694 https://cve.radiocsirt.org/vuln/fkie_cve-2019-1020002 <p>Pterodactyl before 0.7.14 with 2FA allows credential sniffing.</p> <p>Pterodactyl before 0.7.14 with 2FA allows credential sniffing.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-1020002 https://cve.radiocsirt.org/vuln/ghsa-fg52-xjfc-9rh8 <p><strong>Affected:</strong> Packagist: pterodactyl/panel</p> <p>**Pterodactyl version 0.7.13 and lower - 2FA Sniffing**</p> <p>Users who have enabled 2FA protections on their account can unintentionally have their account&#39;s existence sniffed by malicious users who enter random credentials into the login fields.</p> <p>### Impact Users who have enabled 2FA protections on their account can unintentionally have their account&#39;s existence sniffed by malicious users who enter random credentials into the login fields.</p> <p>A logical mistake was made when the original code was written that would wait to verify the user&#39;s password until they had provided 2FA credentials if it was enabled on their account. However, because of this you could enter a bad password for a known email and determine if the account exists if you got redirected to a 2FA page.</p> <p>### For more information If you have any questions or comments about this advisory please react out on Discord or email dane@[project name].io.</p> <p><strong>Affected:</strong> Packagist: pterodactyl/panel</p> <p>**Pterodactyl version 0.7.13 and lower - 2FA Sniffing**</p> <p>Users who have enabled 2FA protections on their account can unintentionally have their account&#39;s existence sniffed by malicious users who enter random credentials into the login fields.</p> <p>### Impact Users who have enabled 2FA protections on their account can unintentionally have their account&#39;s existence sniffed by malicious users who enter random credentials into the login fields.</p> <p>A logical mistake was made when the original code was written that would wait to verify the user&#39;s password until they had provided 2FA credentials if it was enabled on their account. However, because of this you could enter a bad password for a known email and determine if the account exists if you got redirected to a 2FA page.</p> <p>### For more information If you have any questions or comments about this advisory please react out on Discord or email dane@[project name].io.</p> https://cve.radiocsirt.org/vuln/ghsa-fg52-xjfc-9rh8 https://cve.radiocsirt.org/vuln/gsd-2019-1020002 gsd-2019-1020002 https://cve.radiocsirt.org/vuln/gsd-2019-1020002