CVE-2026-61609 affects Pterodactyl, a free open-source game server management panel, across versions 1.7.0 through 1.13.0. The vulnerability stems from a misconfigured authentication rate limiter in RouteServiceProvider::configureRateLimiting() that uses a single global bucket instead of per-IP or per-account keying. Because the Limit::perMinute(10) call omits ->by(), Laravel generates a constant cache key (md5('authentication')) shared across all requests. An unauthenticated attacker can exhaust this shared counter with just ~10 requests per minute, triggering HTTP 429 responses for all users trying to log in or complete two-factor authentication. The two-factor checkpoint endpoint is particularly easy to exploit as it lacks reCAPTCHA protection. This results in a panel-wide denial of service affecting all users including administrators. The issue has been patched in Pterodactyl version 1.13.0.