CVE-2026-40585: blueprintUE: Password Reset Tokens Have No Expiry Window
blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a password reset is initiated, a 128-character CSPRNG token is generated and stored alongside a passwordresetat timestamp. However, the token redemption function findUserIDFromEmailAndToken() queries only for a matching email + passwordreset token pair — it does not check whether the passwordresetat timestamp has elapsed any maximum window. A generated reset token is valid indefinitely until it is explicitly consumed or overwritten by a subsequent reset request. This vulnerability is fixed in 4.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
blueprintUEto a version that resolves this vulnerability.Fixed in 4.2.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40585?
CVE-2026-40585 is considered a high-severity vulnerability due to the potential for unauthorized access to user accounts.
How do I fix CVE-2026-40585?
To fix CVE-2026-40585, upgrade blueprintUE to version 4.2.0 or later which implements expiry for password reset tokens.
What type of vulnerability is CVE-2026-40585?
CVE-2026-40585 is classified as an authentication vulnerability that allows for potential account takeover.
Which versions of blueprintUE are affected by CVE-2026-40585?
CVE-2026-40585 affects all versions of blueprintUE prior to 4.2.0.
What is the impact of CVE-2026-40585?
The impact of CVE-2026-40585 includes prolonged validity of password reset tokens, allowing attackers to exploit them without a time limit.