CVE-2026-40588

OVERVIEW CVE-2026-40588 is an authentication bypass vulnerability in blueprintUE, a development tool for Unreal Engine, affecting all versions prior to 4.2.0. The password change functionality at the /profile/{slug}/edit/ endpoint fails to implement current password verification, allowing attackers to reset account passwords without knowledge of the original credentials. SEVERITY The vulnerability carries a CVSS score of 8.1 (HIGH) with a network-based attack vector, low complexity, and requirement for prior authentication. An attacker with a valid authenticated session can exploit this flaw to achieve complete account takeover by changing the target user's password. Sessions can be compromised through various means including XSS exploitation, session sidejacking over unencrypted HTTP connections, physical access to logged-in browsers, or stolen "remember me" cookies. The attack results in high confidentiality and integrity impacts. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, with no public exploit code availability reported. The vulnerability is not included on the CISA Known Exploited Vulnerabilities (KEV) catalog and has an extremely low EPSS score of 0.00033, indicating minimal observed exploitation activity across the security community. The threat remains theoretical at present, though the moderate FAUCET risk score of 49.0 suggests organizations should prioritize patching to version 4.2.0.