Threats tagged 'ghsa-pc87-6hr3-m9jr'

blueprintUE self-hosted edition versions prior to 4.3.4 have a vulnerability related to insufficient session expiration. This flaw allows attackers to reuse stale account confirmation tokens because the system does not properly consider the token's confirmation timestamp. Attackers with access to old confirmation links can activate unconfirmed accounts and bypass cleanup mechanisms.