EUVD-2026-117092

BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames. Unauthenticated attackers can vary username casing against case-insensitive MySQL lookups to get extra attempts a...

CVE-2026-122138

The BlueprintUE Self-Hosted Edition (versions 4.2.0 before 4.3.4 ) is vulnerable to a login rate limit bypass in LoginMiddleware.php. The root cause is that failed-login counters are keyed using case-sensitive usernames , while the underlying MySQL lookups are case-insensitive. This allows unauth...

PT-2026-137160

BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames. Unauthenticated attackers can vary username casing against case-insensitive MySQL lookups to get extra attempts a...