CVE-2026-40586

CVE-2026-40586 affects blueprintUE versions prior to 4.2.0, a development tool for Unreal Engine. The vulnerability exists in the login form handler, which lacks all standard authentication protections including rate limiting, IP-based throttling, account lockout mechanisms, and CAPTCHA challenges. This allows attackers to conduct unlimited credential guessing attacks, including dictionary attacks and credential stuffing campaigns against user accounts. The vulnerability carries a CVSS score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction, making it easily exploitable. The primary impact is unauthorized access to user accounts and potential compromise of confidential information, though the attack does not affect system integrity or availability. While the password policy requirements (10+ characters, mixed case, digits, special characters) provide some protection, they do not adequately mitigate the risk of targeted attacks against users with predictable passwords. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog and shows no evidence of active exploitation in the wild. The extremely low EPSS score of 0.0005 indicates minimal real-world exploitation activity to date. However, the moderate FAUCET Risk Score of 48.0/100 suggests the vulnerability warrants attention, and organizations using blueprintUE versions prior to 4.2.0 should prioritize upgrading to remediate this authentication weakness.