The vulnerability in blueprintue-self-hosted-edition (before version 4.2.0) is an improper restriction of excessive authentication attempts (CWE-307). The login form handler does not implement any throttling mechanisms such as IP-based rate limiting, per-account attempt counters, temporary lockouts, progressive delays, or CAPTCHA challenges. This allows attackers to submit unlimited credential guesses rapidly. Although the password policy requires complex passwords, it does not prevent attacks leveraging breached credentials or predictable passwords. The issue is resolved in version 4.2.0.

An attacker can perform brute force or credential stuffing attacks without limitation, potentially leading to unauthorized access to user accounts. The vulnerability compromises confidentiality but does not affect integrity or availability. The lack of throttling increases the risk of account compromise, especially for users with reused or weak passwords despite the password policy.

Upgrade blueprintue-self-hosted-edition to version 4.2.0 or later, where this vulnerability is fixed by implementing proper throttling and rate limiting on authentication attempts. Since no official patch links or advisories are provided beyond this version information, users should verify the upgrade from the vendor. Patch status is confirmed fixed in 4.2.0.