CVE-2024-49762: Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled

When a user disables two-factor authentication via the Panel, a DELETE request with their current password in a query parameter will be sent. While query parameters are encrypted when using TLS, many webservers (including ones officially documented for use with Pterodactyl) will log query parameters in plain-text, storing a user’s password in plain text.

If a malicious user obtains access to these logs they could potentially authenticate against a user’s account; assuming they are able to discover the account’s email address or username separately.