Vulnerability · Published Nov 4, 2026 · Assigned by VulnCheck

CVE-2026-122138BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass

Medium 5.3

In plain English

A medium-severity security flaw in blueprintue-self-hosted-edition from blueprintue. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 73.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames. Unauthenticated attackers can vary username casing against case-insensitive MySQL lookups to get extra attempts and brute-force passwords past the per-account lockout.

Affected products (as reported)

Vendor	Product	Versions
blueprintue	blueprintue-self-hosted-edition	4.2.0 – before 4.3.4

Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

GitHub Security Advisory (GHSA-773r-585g-6vc3) vendor-advisory
https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/bd4af38d2f7d499be23fc4106f93980a1348ddd7 patch
https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/267 patch, issue-tracking
blueprintue-self-hosted-edition v4.3.4 Release Notes release-notes
https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.3/app/middlewares/LoginMiddleware.php#L119-L158 technical-description
VulnCheck Advisory: BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass third-party-advisory