CVE-2026-40585 | blueprintue blueprintue-self-hosted-edition up to 4.1.x Password Reset findUserIDFromEmailAndToken password recovery (GHSA-qr65-6vp8-whjf)

VDB-358535 · CVE-2026-40585 · GHSA-QR65-6VP8-WHJF BLUEPRINTUE BLUEPRINTUE-SELF-HOSTED-EDITION UP TO 4.1.X PASSWORD RESET FINDUSERIDFROMEMAILANDTOKEN PASSWORD RECOVERY HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 6.4 $0-$5k 1.74+ Summaryinfo A vulnerability identified as problematic has been detected in blueprintue blueprintue-self-hosted-edition up to 4.1.x. Affected by this issue is the function findUserIDFromEmailAndToken of the component Password Reset Handler. The manipulation leads to password recovery. This vulnerability is referenced as CVE-2026-40585. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component. Detailsinfo A vulnerability, which was classified as problematic, has been found in blueprintue blueprintue-self-hosted-edition up to 4.1.x. This issue affects the function findUserIDFromEmailAndToken of the component Password Reset Handler. The manipulation with an unknown input leads to a password recovery vulnerability. Using CWE to declare the problem leads to CWE-640. The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak. Impacted is confidentiality, integrity, and availability. The summary by CVE is: blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a password reset is initiated, a 128-character CSPRNG token is generated and stored alongside a password_reset_at timestamp. However, the token redemption function findUserIDFromEmailAndToken() queries only for a matching email + password_reset token pair — it does not check whether the password_reset_at timestamp has elapsed any maximum window. A generated reset token is valid indefinitely until it is explicitly consumed or overwritten by a subsequent reset request. This vulnerability is fixed in 4.2.0. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-40585 since 04/14/2026. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK. Upgrading to version 4.2.0 eliminates this vulnerability. Productinfo Vendor blueprintue Name blueprintue-self-hosted-edition Version 4.0 4.1 Website Product: https://github.com/blueprintue/blueprintue-self-hosted-edition/ CPE 2.3info 🔒 🔒 CPE 2.2info 🔒 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv3info VulDB Meta Base Score: 6.5 VulDB Meta Temp Score: 6.4 VulDB Base Score: 5.6 VulDB Temp Score: 5.4 VulDB Vector: 🔒 VulDB Reliability: 🔍 CNA Base Score: 7.4 CNA Vector (GitHub_M): 🔒 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Password recovery CWE: CWE-640 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Yes Availability: 🔒 Status: Not defined Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Upgrade Status: 🔍 0-Day Time: 🔒 Upgrade: blueprintue-self-hosted-edition 4.2.0 Timelineinfo 04/14/2026 CVE reserved 04/21/2026 +7 days Advisory disclosed 04/21/2026 +0 days VulDB entry created 04/21/2026 +0 days VulDB entry last update Sourcesinfo Product: github.com Advisory: GHSA-qr65-6vp8-whjf Status: Confirmed CVE: CVE-2026-40585 (🔒) GCVE (CVE): GCVE-0-2026-40585 GCVE (VulDB): GCVE-100-358535 Entryinfo Created: 04/21/2026 19:41 Changes: 04/21/2026 19:41 (65) Complete: 🔍 Cache ID: 99:8C7:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸