---
id: "CVE-2026-122138"
kind: "vulnerability"
aliases: ["CVE-2026-122138"]
title: "BlueprintUE: login rate limit bypass lets attackers brute-force passwords"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["blueprintue", "mysql", "package", "php", "self-hosted"]
not_affected_if: ["managed-hosting", "not-self-hosted"]
published_at: "2026-11-04T21:18:10+00:00"
first_seen_at: "2026-11-04T21:49:20+00:00"
updated_at: "2026-11-04T21:51:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122138", "first_seen_at": "2026-11-04T21:49:20+00:00"}]
exploit_sources: []
---

# BlueprintUE: login rate limit bypass lets attackers brute-force passwords

BlueprintUE Self-Hosted Edition before 4.3.4 counts failed logins per case-sensitive username, while MySQL matches usernames case-insensitively. An unauthenticated attacker can vary username casing to get extra attempts and brute-force passwords past the per-account lockout.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed BlueprintUE Self-Hosted Edition version; affected versions are `4.2.0` before `4.3.4`.
- Review `LoginMiddleware.php` for how failed-login counters are keyed.

## Fix

- BlueprintUE Self-Hosted Edition: upgrade to `4.3.4` or later (per the NVD description).

## Timeline

- 2026-11-04T21:49:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122138

## Documents

- [advisory] Vendor advisory: github.com https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-773r-585g-6vc3
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/blueprintue-self-hosted-edition-4.2.0-before-4.3.4-login-rate-limit-bypass
- [fix] Release notes: github.com https://github.com/blueprintue/blueprintue-self-hosted-edition/releases/tag/v4.3.4
- [fix] Patch: github.com https://github.com/blueprintue/blueprintue-self-hosted-edition/commit/bd4af38d2f7d499be23fc4106f93980a1348ddd7

## From the sources

BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames. Unauthenticated attackers can vary username casing against case-insensitive MySQL lookups to get extra attempts and brute-force passwords past the per-account lockout.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_