CVE-2026-40585
blueprintUE: Password Reset Tokens Have No Expiry Window
CVSS Score
7.4
EPSS Score
0.0%
EPSS Percentile
0th
blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a password reset is initiated, a 128-character CSPRNG token is generated and stored alongside a password_reset_at timestamp. However, the token redemption function findUserIDFromEmailAndToken() queries only for a matching email + password_reset token pair — it does not check whether the password_reset_at timestamp has elapsed any maximum window. A generated reset token is valid indefinitely until it is explicitly consumed or overwritten by a subsequent reset request. This vulnerability is fixed in 4.2.0.
| CWE | CWE-640 |
| Vendor | blueprintue |
| Product | blueprintue-self-hosted-edition |
| Published | Apr 21, 2026 |
| Last Updated | Apr 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for blueprintue blueprintue-self-hosted-edition
Be the first to know when new high vulnerabilities affecting blueprintue blueprintue-self-hosted-edition are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
blueprintue / blueprintue-self-hosted-edition
< 4.2.0