CVE-2026-40588 - Vulnerability Analysis

Overview

blueprintUE prior to 4.2.0 contains a broken authentication caused by missing current_password verification in the password change form at /profile/{slug}/edit/, letting attackers with a valid authenticated session change account passwords without knowing the original password, exploit requires attacker to have a valid authenticated session.

Severity & Score

Impact

Attackers with a valid session can change account passwords, leading to permanent account takeover.

Mitigation

Upgrade to version 4.2.0 or later.

References

• https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-73f2-p9jr-m44x

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 21, 2026

🟠 CVE-2026-40588 - High (8.1) blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the password change form at /profile/{slug}/edit/ does not include a current_password field and does not verify the user's existing password before accepting a new one. Any at... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40588/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner