Iframe Injection Vulnerability in BlueprintUE Self-Hosted Edition

CVE-2026-126814

What is CVE-2026-126814?

The BlueprintUE Self-Hosted Edition, prior to version 4.3.6, is susceptible to an iframe injection vulnerability that can be exploited by authenticated users. This flaw allows attackers to embed arbitrary content by manipulating the PeerTube video URL matcher through the BlueprintService::findVideoProvider() method. When attackers control a blueprint video URL, the associated URL gets loaded into the application in an unsandboxed iframe post user consent. This can lead to the presentation of malicious content such as fake login forms or unwanted malware downloads to users, posing significant security risks.

References