PT-2026-137160

CVE-2026-122138

·

Published

2026-11-04

·

Updated

2026-11-04

Description by

CVSS 3.1
5.3
Medium
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames. Unauthenticated attackers can vary username casing against case-insensitive MySQL lookups to get extra attempts and brute-force passwords past the per-account lockout.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-307: Improper Restriction of Excessive Authentication Attempts
Related identifiers
CVE-2026-122138
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com