PT-2026-137160

CVE-2026-122138

Published

2026-11-04

Updated

2026-11-04

Description by

CVSS 4.0

6.3

Medium

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions BlueprintUE Self-Hosted Edition versions 4.2.0 through 4.3.3

Description An issue exists in LoginMiddleware.php where failed login counters are based on case-sensitive usernames. Because MySQL lookups are case-insensitive, unauthenticated attackers can bypass the per-account lockout and perform brute-force password attacks by varying the casing of the username.

Recommendations Update BlueprintUE Self-Hosted Edition to version 4.3.4 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Farhan Khan

Rancoud

Vendors

Affected products

Weakness enumeration

CWE-307: Improper Restriction of Excessive Authentication Attempts