Blueprintue vulnerabilities
We track 5 vulnerabilities in Blueprintue products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on November 11, 2026.
Latest Blueprintue vulnerabilities
- 9.8 Critical severity
blueprintue-self-hosted-edition: Empty Password in Configuration File
blueprintUE Self-Hosted Edition before 4.3.7 contains an insecure default configuration in its Docker Compose examples that sets MYSQL_ALLOW_EMPTY_PASSWORD=yes in database.env and publishes MariaDB on port 3306. Unauthenticated attackers reaching the Docker ho
- 7.5 High severity
blueprintue-self-hosted-edition: Allocation of Resources Without Limits or Throttling
BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 contains a resource exhaustion vulnerability that allows unauthenticated attackers to fill server storage by repeatedly creating anonymous blueprints. Attackers can send large requests to HomeController::doPro
- 8.1 High severity
blueprintue-self-hosted-edition: Unverified Password Change
blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the password change form at /profile/{slug}/edit/ does not include a current_password field and does not verify the user's existing password before accepting a new one. Any attacker who ob
- 7.5 High severity
blueprintue-self-hosted-edition: Improper Restriction of Excessive Authentication Attempts
blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the login form handler performs no throttling of any kind. Failed authentication attempts are processed at full network speed with no IP-based rate limiting, no per-account attempt counter
- 7.4 High severity
blueprintue-self-hosted-edition: Weak Password Recovery Mechanism for Forgotten Password
blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a password reset is initiated, a 128-character CSPRNG token is generated and stored alongside a password_reset_at timestamp. However, the token redemption function findUserIDFromEmail