GHSA-qp6g-7v4v-33r9: blueprintUE Self-Hosted Edition before 4.3.4 Non-Expiring Account Confirmation Tokens
blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores confirmedsentat. Attackers who obtain an old confirmation link from a compromised mailbox, backup, or forwarded mail can activate unconfirmed accounts and evade the unconfirmed-account cleanup job.
Event History
Frequently Asked Questions
Which deployments are affected?
Self-hosted blueprintUE deployments running versions before 4.3.4 are affected. The issue concerns account-confirmation links for accounts that remain unconfirmed.
What must an attacker have to exploit this?
An attacker needs an old account-confirmation link for an unconfirmed account. Such links may be obtained from a compromised mailbox, backups, or forwarded email.
What is the practical impact of a stale confirmation link?
The link can still activate the unconfirmed account because confirmation-token validation ignores confirmed_sent_at. This can also prevent the unconfirmed-account cleanup job from removing that account.