CVE-2026-40586

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40586
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40586.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40586
Aliases
  • GHSA-m6c2-6p3h-8jv2
Published
2026-04-21T17:10:05Z
Modified
2026-08-12T03:51:09Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
blueprintUE: Login Endpoint Has No Rate Limiting, Lockout, or Brute-Force Protection
Details

blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the login form handler performs no throttling of any kind. Failed authentication attempts are processed at full network speed with no IP-based rate limiting, no per-account attempt counter, no temporary lockout, no progressive delay (Tarpit), and no CAPTCHA challenge. An attacker can submit an unlimited number of credential guesses. The password policy (10+ characters, mixed case, digit, special character) reduces the effective keyspace but does not prevent dictionary attacks, credential stuffing from breached databases, or targeted attacks against known users with predictable passwords. This vulnerability is fixed in 4.2.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-307"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40586.json"
}
References

Affected packages

Git / github.com/blueprintue/blueprintue-self-hosted-edition

Affected ranges

Type
GIT
Repo
https://github.com/blueprintue/blueprintue-self-hosted-edition
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
28689950b0fc1c6a0c5db2a034a03fdc9747467c
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.2.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v2.*
v2.0.0
v2.0.1
v2.1.0
v3.*
v3.0.0
v3.1.0
v3.2.0
v4.*
v4.0.0
v4.1.0
v4.1.1
v4.1.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40586.json"