CVE Feed

    Dashboard / CVE / CVE-2026-122138

    CVE-2026-122138

    BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames. Unauthenticated attackers can vary username casing against case-insensitive MySQL lookups to get extra attempts and brute-force passwords past the per-account lockout.

    Published:Nov 4, 2026
    Last Modified:Nov 4, 2026
    EPS:Nov 4, 2026
    EPSS Score:
    CVSS Score:5.3

    Affected Products

    Vendor
    Blueprintue
    Product
    Blueprintue-self-hosted-edition

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-122139 (CVSS 6.9) — blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMi…
    CVE-2026-121735 (CVSS 6.3) — blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that al…
    CVE-2026-40588 (CVSS 8.1) — blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the password change form at /profile/{…
    CVE-2026-40587 (CVSS 6.5) — blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a user changes their password via…
    CVE-2026-40586 (CVSS 7.5) — blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the login form handler performs no thr…
    CVE-2026-40585 (CVSS 7.4) — blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a password reset is initiated, a …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High