CVE-2026-40588: blueprintUE: Authenticated Password Change Does Not Verify Current Password
blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the password change form at /profile/{slug}/edit/ does not include a currentpassword field and does not verify the user's existing password before accepting a new one. Any attacker who obtains a valid authenticated session — through XSS exploitation, session sidejacking over HTTP, physical access to a logged-in browser, or a stolen "remember me" cookie — can immediately change the account password without knowing the original credential, resulting in permanent account takeover. This vulnerability is fixed in 4.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
blueprintUEto a version that resolves this vulnerability.Fixed in 4.2.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40588?
CVE-2026-40588 is considered to have a medium severity due to the potential for unauthorized password changes.
How do I fix CVE-2026-40588?
To fix CVE-2026-40588, upgrade to blueprintUE version 4.2.0 or later, which includes a current_password verification field.
What is the impact of CVE-2026-40588?
The impact of CVE-2026-40588 allows attackers to change user passwords without verifying their identity.
Which versions of blueprintUE are affected by CVE-2026-40588?
BlueprintUE versions prior to 4.2.0 are vulnerable to CVE-2026-40588.
Can CVE-2026-40588 be exploited remotely?
Yes, CVE-2026-40588 can be exploited remotely by authenticated users who can access the password change form.