TI-2026-29322 CVE-2026-40586
blueprintUE: Login Endpoint Has No Rate Limiting, Lockout, or Brute-Force Protection
Priority HIGH 72
blueprintUE is a tool to help Unreal Engine developers.
blueprintue
Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
blueprintue records in CISA KEVNo blueprintue vulnerabilities are listed in CISA KEV.
Records
7 records
TI-2026-29324 CVE-2026-40588
blueprintUE: Authenticated Password Change Does Not Verify Current Password
Priority HIGH 70
blueprintUE is a tool to help Unreal Engine developers.
Priority HIGH 68
blueprintUE is a tool to help Unreal Engine developers.
TI-2026-29323 CVE-2026-40587
blueprintUE: Active Sessions Are Not Invalidated After Password Change or Reset
Priority MEDIUM 64
blueprintUE is a tool to help Unreal Engine developers.
TI-2026-85180 CVE-2026-122139 · GHSA-6v33-jwgx-fxf7
Account enumeration via password reset in blueprintUE Self-Hosted Edition
Priority LOW 30
blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses.
TI-2026-85179 CVE-2026-122138 · GHSA-3x4w-vq7f-5f76
Login rate limit bypass in BlueprintUE Self-Hosted Edition
Priority LOW 28
BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames.
TI-2026-84856 CVE-2026-121735 · GHSA-pc87-6hr3-m9jr
Stale confirmation tokens activate accounts in blueprintUE Self-Hosted Edition
Priority LOW 28
blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm accounts using stale tokens because UserModel::findUserIDWithConfirmedToken ignores…