NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐹 Go🐘 Packagist
Not in CISA KEV

Pterodactyl Panel's SFTP sessions remain active after user account deletion or password changeGHSA-hr7j-63v7-vj7g

Fix: pterodactyl/panel@0e74f3a

GHSA-hr7j-63v7-vj7g is a security vulnerability in github.com/pterodactyl/wings. A fix is available for github.com/pterodactyl/wings — see the affected versions and patch details below.

Also known asGO-2026-4497
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Feb 23, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

2 pkgs affected
🐹github.com/pterodactyl/wings🐘pterodactyl/panel

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go, Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Deleting a user account with SFTP access or changing the user's password does not immediately terminate existing SFTP sessions, allowing continued filesystem access after credentials are revoked. This can result in unintended and unauthorized access to server files even after administrators believe access has been fully invalidated.

Details

When a user with SFTP access is deleted from the Pterodactyl Panel or when the user's password is changed while one or more SFTP connections are active, those existing connections remain fully functional.

Neither account deletion nor password change invalidates the authentication state of already-established SFTP sessions. As a result, the active SFTP connection pool continues to allow read and write operations until the client disconnects or the session times out.

This behavior occurs even when the password is changed by an administrator through the panel, meaning credential rotation does not revoke active access.

This suggests that active SFTP sessions are not tracked or forcefully terminated on credential revocation events. This effectively prevents administrators from responding to credential compromise incidents in real time.

PoC

Scenario 1: Account deletion

  1. Create a user with SFTP access to a server.
  2. Connect to the server via SFTP using any SFTP client (e.g. sftp, FileZilla).
  3. Keep the SFTP session open and active.
  4. Delete the user account from the Pterodactyl Panel.
  5. Continue performing file operations through the already-established SFTP connection.

Result: The SFTP session remains active and usable despite the user account being deleted.

Scenario 2: Password change

  1. Create a user with SFTP access to a server.
  2. Establish an active SFTP connection.
  3. Change the user's password (including via administrator panel).
  4. Continue performing file operations using the existing SFTP connection.

Result: The SFTP session remains active and usable even after the password has been changed.

Impact

This issue prevents immediate revocation of compromised credentials. Vulnerability type: Access control / session invalidation issue

Impacted parties:

  1. Server administrators
  2. Hosting providers using Pterodactyl Panel

Security impact:

Deleted users may retain filesystem access longer than intended, which can lead to:

  1. Unauthorized data access
  2. Data modification or deletion
  3. Compliance and security policy violations

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/pterodactyl/wingsall versions1.12.1go get github.com/pterodactyl/wings@v1.12.1
🐘Packagistpterodactyl/panelall versions1.12.1composer require pterodactyl/panel:^1.12.1

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/pterodactyl/wings, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/pterodactyl/wings to 1.12.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-hr7j-63v7-vj7g is resolved across your whole dependency graph.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Frequently Asked Questions

### Summary Deleting a user account with SFTP access or changing the user's password does not immediately terminate existing SFTP sessions, allowing continued filesystem access after credentials are revoked. This can result in unintended and unauthorized access to server files even after administrators believe access has been fully invalidated. ### Details When a user with SFTP access is deleted from the Pterodactyl Panel or when the user's password is changed while one or more SFTP connections are active, those existing connections remain fully functional. Neither account deletion nor pass
O3 Security · Impact-Aware SCA

Is GHSA-hr7j-63v7-vj7g in your dependencies?

Find it across Go, Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
Pterodactyl Panel's SFTP sessions remain active after…