PT-2026-34023 · Unknown · Blueprintue

Published 2026-04-21 · Updated 2026-04-21 · CVE-2026-40586

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions blueprintUE versions prior to 4.2.0

Description The login form handler does not implement throttling for authentication attempts. This lack of IP-based rate limiting, per-account attempt counters, temporary lockouts, progressive delays (Tarpit), or CAPTCHA challenges allows an attacker to submit an unlimited number of credential guesses. While the password policy requires 10+ characters with mixed case, digits, and special characters, it does not prevent dictionary attacks, credential stuffing from breached databases, or targeted attacks against users with predictable passwords.

Recommendations Update to version 4.2.0.

Exploit

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2026-40586

Affected Products

Blueprintue

References · 4

• 🔥 https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-m6c2-6p3h-8jv2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-40586 · Security Note
• https://twitter.com/infoflowcloud/status/2046676613836796034 · Twitter Post
• https://twitter.com/CVEnew/status/2046675014691213670 · Twitter Post