CVE-2026-122138
5.3 MEDIUMpublic exploit availablePublished 2026-11-04 · Updated 2026-11-04
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames. Unauthenticated attackers can vary username casing against case-insensitive MySQL lookups to get extra attempts and brute-force passwords past the per-account lockout.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-307
Public exploit & PoC references
- https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.3/app/middlewares/LoginMiddleware.php#L119-L158
- https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/bd4af38d2f7d499be23fc4106f93980a1348ddd7
- https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/267
- https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.4
- https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-773r-585g-6vc3
All references
- https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.3/app/middlewares/LoginMiddleware.php#L119-L158
- https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/bd4af38d2f7d499be23fc4106f93980a1348ddd7
- https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/267
- https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.4
- https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-773r-585g-6vc3
- https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-4.2.0-before-4.3.4-login-rate-limit-bypass
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2024-2323
- MEDIUMCVE-2026-100501PoC
- MEDIUMCVE-2026-100678PoC
- HIGHCVE-2026-102334PoC
- LOWCVE-2026-102825PoC
- HIGHCVE-2026-103977PoC
- LOWCVE-2026-105237PoC
- CRITICALCVE-2026-105638PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.