CVE-2021-41176

    Dashboard / Vulnerabilities / CVE-2021-41176

    CVE-2021-41176

    Published: 25 Oct 2021Last Modified: 7 Aug 2026

    Summary:

    Details: Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted attack against a specific Panel instance, and serves only to sign a user out. **No user details are leaked, nor is any user data affected, this is simply an annoyance at worst.** This is fixed in version 1.6.3.

    References: https://github.com/pterodactyl/panel/releases/tag/v1.6.3, https://github.com/pterodactyl/panel/security/advisories/GHSA-m49f-hcxp-6hm6, https://github.com/pterodactyl/panel/commit/45999ba4ee1b2dcb12b4a2fa2cedfb6b5d66fac2

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -d65e2978d0af2a41375c1b313663071933d5158a

    Affected versions

    v1.6.2
    v1.6.1
    v1.6.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-41176 | CVE-DB