CVE-2026-122138 · Package
NO FIX YET · SEE WHAT TO DO
BlueprintUE Self-Hosted Edition before 4.3.4 counts failed logins per case-sensitive username, while MySQL matches usernames case-insensitively. An unauthenticated attacker can vary username casing to get extra attempts and brute-force passwords past the per-account lockout.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running BlueprintUE Self-Hosted Edition from 4.2.0 up to but not including 4.3.4 with a MySQL backend, where login is reachable from the internet or the network. Hosted BlueprintUE instances are not the vendor's self-hosted edition and are not covered by this entry, so unknown for them.
Not affected if managed-hosting, not-self-hosted
Who cares blueprintue, mysql, php, self-hosted
4.2.0 before 4.3.4.LoginMiddleware.php for how failed-login counters are keyed.4.3.4 or later (per the NVD description).BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames. Unauthenticated attackers can vary username casing against case-insensitive MySQL lookups to get extra attempts and brute-force passwords past the per-account lockout.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.