Threats tagged 'ghsa-3x4w-vq7f-5f76'

BlueprintUE Self-Hosted Edition versions from 4.2.0 up to but not including 4.3.4 have a login rate limit bypass vulnerability. The flaw exists because the login middleware keys failed-login counters on case-sensitive usernames, while the underlying MySQL lookups are case-insensitive. This mismatch allows unauthenticated attackers to bypass per-account lockout by varying username casing and thus gain additional brute-force attempts.