CVE-2026-40588
blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the password change form at /profile/{slug}/edit/ does not include a current_password field and does not verify the user's existing password before accepting a new one. Any attacker who obtains a valid authenticated session — through XSS exploitation, session sidejacking over HTTP, physical access to a logged-in browser, or a stolen "remember me" cookie — can immediately change the account password without knowing the original credential, resulting in permanent account takeover. This vulnerability is fixed in 4.2.0.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- EPSS probability
- 0.21%
- CWE
- CWE-620
- Published
- 2026-04-21
- Last modified
- 2026-04-22
Affected products
- blueprintue blueprintue-self-hosted-edition
Weakness type
Related vulnerabilities
- CVE-2026-86260 — sfturing hosp_order Password Recovery CommonUserController.java modifyPassWord unverified password change
- CVE-2026-85591 — phpMyFAQ before 4.1.8 Authentication Bypass via Unverified Password Change
- CVE-2026-77644 — Critical Bypass Access Control Vulnerability Reported for Windchill Risk and Reliability (WRR) Enterprise Edition
- CVE-2026-76633 — WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha
- CVE-2026-73292 — Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation
- CVE-2026-17599 — Nexus Repository 3 - Unverified Onboarding State on change-admin-password Endpoint
- CVE-2026-15964 — Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change
- CVE-2026-12692 — Improper Authentication in Vimesoft's Enterprise Video Platform