{"id":"CVE-2026-122138","title":"BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass","summary":"BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames. Unauthenticated attackers can vary username casing ag…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-307"],"vendor":"blueprintue","product":"blueprintue-self-hosted-edition","affected":["blueprintue-self-hosted-edition >= 4.2.0 < 4.3.4"],"published":"2026-11-04","updated":"2026-11-04","sourceUpdated":"2026-11-04T20:36:55.818Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-122138","references":[{"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-773r-585g-6vc3","label":"GitHub Security Advisory (GHSA-773r-585g-6vc3)"},{"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/bd4af38d2f7d499be23fc4106f93980a1348ddd7"},{"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/pull/267"},{"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.4","label":"blueprintue-self-hosted-edition v4.3.4 Release Notes"},{"url":"https://github.com/blueprintue/blueprintue-self-hosted-edition/blob/v4.3.3/app/middlewares/LoginMiddleware.php#L119-L158"},{"url":"https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-4.2.0-before-4.3.4-login-rate-limit-bypass","label":"VulnCheck Advisory: BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T21:36:00.566Z","slug":"CVE-2026-122138","body":"## Overview\n\nBlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames. Unauthenticated attackers can vary username casing against case-insensitive MySQL lookups to get extra attempts and brute-force passwords past the per-account lockout.\n\n## Affected\n\n- `blueprintue-self-hosted-edition >= 4.2.0 < 4.3.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}