blueprintUE self-hosted edition versions prior to 4.3.4 have an insufficient session expiration vulnerability. This flaw allows attackers to activate unconfirmed accounts using stale confirmation tokens because the system ignores the token's confirmation timestamp. Attackers with access to old confirmation links can bypass account cleanup mechanisms and confirm accounts improperly.