Read the docs
TI-2026-29324 Aliases CVE-2026-40588

blueprintUE: Authenticated Password Change Does Not Verify Current Password

Priority HIGH 70CWE-620Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the password change form at /profile/{slug}/edit/ does not include a current_password field and does not verify the user's existing password before accepting a new one. Any attacker who obtains a valid authenticated session — through XSS exploitation, session sidejacking over HTTP, physical access to a logged-in browser, or a stolen "remember me" cookie — can immediately change the account password without knowing the original credential, resulting in permanent account takeover. This vulnerability is fixed in 4.2.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00267 18th percentileScored 2026-11-07
Fix Fixed blueprintue-self-hosted-edition (blueprintue): 4.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
blueprintueblueprintue-self-hosted-editionbefore 4.2.04.2.0Patch availableCNA
  • blueprintue-self-hosted-edition Vendorblueprintue Affected before 4.2.0 Fixed in 4.2.0 Patch available CNA

Remediation

  • Fix · CNA blueprintue-self-hosted-edition (blueprintue) Fixed in 4.2.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40588

References

Other 1

  • TI-2026-29322 blueprintUE: Login Endpoint Has No Rate Limiting, Lockout, or Brute-Force Protection CVSS 3.1HIGH 7.5
  • TI-2026-29321 blueprintUE: Password Reset Tokens Have No Expiry Window CVSS 3.1HIGH 7.4
  • TI-2026-29323 blueprintUE: Active Sessions Are Not Invalidated After Password Change or Reset CVSS 3.1MEDIUM 6.5
  • TI-2026-85180 Account enumeration via password reset in blueprintUE Self-Hosted Edition CVSS 4.0MEDIUM 6.9
  • TI-2026-85179 Login rate limit bypass in BlueprintUE Self-Hosted Edition CVSS 4.0MEDIUM 6.3
  • TI-2026-84856 Stale confirmation tokens activate accounts in blueprintUE Self-Hosted Edition CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences