Medium 6.3

BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass

CVE-2026-122138 First seen on SecPulse Nov 5, 05:36

Affected packages

Ecosystem	Package	Affected → Fixed	Fixed
blueprintue	blueprintueblueprintue-self-hosted-edition	≥ 4.2.0, < 4.3.4→ 4.3.4	4.3.4

Original description The description as published by the source.

BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames. Unauthenticated attackers can vary username casing against case-insensitive MySQL lookups to get extra attempts and brute-force passwords past the per-account lockout.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

advisory github.com
advisory github.com
advisory vulncheck.com
advisory nvd.nist.gov
advisory github.com
package github.com
patch github.com
patch github.com
web github.com
web github.com

Key facts

CVSS v3: Medium 5.3; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4: Medium 6.3; CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Published: Nov 5, 2026
First seen on SecPulse: Nov 5, 05:36
GHSA: GHSA-773r-585g-6vc3
CWE: CWE-307

NVD GitHub Advisory

Tags(click for explanation)

Programming Languages

PHP

All

CWE-307 Blueprintue Blueprintue Self Hosted Edition

Detection sources

OSV.dev (Open Source Vulnerabilities)Nov 10, 11:30
NIST National Vulnerability DatabaseNov 10, 02:17
GitHub Security Advisories (Global)Nov 5, 06:32
CVE.org (CVE Program・cvelistV5)Nov 10, 01:59