CVE-2021-41129

CVE-2021-41129 is a high-risk login bypass vulnerability affecting Pterodactyl Panel, an open-source game server management system. A malicious user can manipulate the confirmation_token during two-factor authentication to reference arbitrary cached user IDs, potentially authenticating as another user. While the attack requires the targeted account to have 2FA enabled and a valid 2FA token to be provided, the lack of rate-limiting allows for brute-forcing the token. This vulnerability has a CVSS score of 8.1 (High) due to its network attack vector, high impact on confidentiality, integrity, and availability, despite a high attack complexity. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.