Read the docs
TI-2026-29322 Aliases CVE-2026-40586

blueprintUE: Login Endpoint Has No Rate Limiting, Lockout, or Brute-Force Protection

Priority HIGH 72CWE-307Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-307.

Summary

blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the login form handler performs no throttling of any kind. Failed authentication attempts are processed at full network speed with no IP-based rate limiting, no per-account attempt counter, no temporary lockout, no progressive delay (Tarpit), and no CAPTCHA challenge. An attacker can submit an unlimited number of credential guesses. The password policy (10+ characters, mixed case, digit, special character) reduces the effective keyspace but does not prevent dictionary attacks, credential stuffing from breached databases, or targeted attacks against known users with predictable passwords. This vulnerability is fixed in 4.2.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00366 30th percentileScored 2026-11-07
Fix Fixed blueprintue-self-hosted-edition (blueprintue): 4.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
blueprintueblueprintue-self-hosted-editionbefore 4.2.04.2.0Patch availableCNA
  • blueprintue-self-hosted-edition Vendorblueprintue Affected before 4.2.0 Fixed in 4.2.0 Patch available CNA

Remediation

  • Fix · CNA blueprintue-self-hosted-edition (blueprintue) Fixed in 4.2.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40586

References

Other 1

  • TI-2026-29324 blueprintUE: Authenticated Password Change Does Not Verify Current Password CVSS 3.1HIGH 8.1
  • TI-2026-29321 blueprintUE: Password Reset Tokens Have No Expiry Window CVSS 3.1HIGH 7.4
  • TI-2026-29323 blueprintUE: Active Sessions Are Not Invalidated After Password Change or Reset CVSS 3.1MEDIUM 6.5
  • TI-2026-85180 Account enumeration via password reset in blueprintUE Self-Hosted Edition CVSS 4.0MEDIUM 6.9
  • TI-2026-85179 Login rate limit bypass in BlueprintUE Self-Hosted Edition CVSS 4.0MEDIUM 6.3
  • TI-2026-84856 Stale confirmation tokens activate accounts in blueprintUE Self-Hosted Edition CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences