Insufficient Session Expiration Vulnerability in blueprintUE Self-Hosted Edition

CVE-2026-121735

What is CVE-2026-121735?

blueprintUE Self-Hosted Edition prior to version 4.3.4 contains a vulnerability that allows attackers to exploit stale session tokens. The UserModel::findUserIDWithConfirmedToken function fails to consider the confirmed_sent_at parameter, permitting potentially unauthorized account confirmations through old confirmation links that could be retrieved from a compromised email, backup, or a forwarded message. This flaw undermines the integrity of the user account confirmation process, allowing attackers to utilize unconfirmed tokens to activate accounts and bypass necessary security measures intended to clean up unconfirmed accounts.

References