Farhan Khan

An issue exists where unauthenticated attackers can cause resource exhaustion by repeatedly creating anonymous blueprints to fill server storage. This is achieved by sending large requests to the `HomeController::doProcessCreateBlueprint()` function with the `expiration` variable set to 'never', which bypasses automatic purges and leads to a denial of service.

An insecure default configuration in Docker Compose examples allows unauthenticated remote attackers to access the MariaDB database. The issue occurs because the `MYSQL ALLOW EMPTY PASSWORD` variable is set to `yes` in the `database.env` file and the database is published on port 3306. This allows an attacker to log in as root without a password to read, modify, or delete user accounts, blueprints, and all databases.

blueprintUE Self-Hosted Edition before 4.3.6 contains an iframe injection vulnerability that allows authenticated users to embed arbitrary third-party content by abusing the PeerTube video URL matcher in BlueprintService::findVideoProvider(). Attackers can set a blueprint video URL on an attacker-controlled host, which site.js loads in an unsandboxed iframe after consent, framing fake login forms or malware downloads.

An issue exists in `LoginMiddleware.php` where failed login counters are based on case-sensitive usernames. Because MySQL lookups are case-insensitive, unauthenticated attackers can bypass the per-account lockout and perform brute-force password attacks by varying the casing of the username.

An account enumeration issue exists in the `ForgotPasswordMiddleware.php` file. Unauthenticated attackers can identify registered email addresses by comparing password reset redirect targets for submitted emails. Because failed lookups are not rate-limited, attackers can perform unlimited enumeration attempts.

An insufficient session expiration issue exists where the `findUserIDWithConfirmedToken()` function in `UserModel` ignores the `confirmed sent at` variable. This allows attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail to activate unconfirmed accounts and evade the cleanup job designed to remove unconfirmed accounts.