The Pterodactyl panel's authentication rate limiter, in versions 1.7.0 through 1.12.x, applies a single global rate limit bucket to POST /auth/login and POST /auth/login/checkpoint endpoints without keying by IP or user account. This is due to the omission of the ->by() method in Laravel's rate limiter configuration, resulting in a constant cache key shared by all requests. An attacker can send approximately ten requests per minute from a single IP to exhaust this shared limit, causing HTTP 429 responses for all users and effectively locking out legitimate login and two-factor authentication attempts. This vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling) and leads to a panel-wide authentication denial of service. The vulnerability is resolved in Pterodactyl panel version 1.13.0.

An unauthenticated attacker can cause a denial of service on the Pterodactyl panel's authentication system by exhausting the global rate limit bucket shared across all login and two-factor authentication requests. This results in HTTP 429 Too Many Requests responses for all users, preventing legitimate login and two-factor authentication attempts, including those by administrators. There is no impact on confidentiality or integrity, but availability of the authentication service is severely affected.

This vulnerability is fixed in Pterodactyl panel version 1.13.0. Users should upgrade to version 1.13.0 or later to remediate this issue. No official patch or temporary fix is indicated in the advisory. Until upgrading, consider implementing additional rate limiting keyed by IP or account at a network or application firewall level to mitigate the risk.