blueprintUE Account Takeover Vulnerability (CVE-2026-40588)

blueprintUE, a tool for Unreal Engine developers, contains a critical vulnerability affecting versions prior to 4.2.0. The password change form at /profile/{slug}/edit/ lacks a current_password field and does not validate the user's existing password. This allows an attacker who has obtained a valid authenticated session to change the account password without knowing the original password. An attacker can obtain a valid session through various means, including XSS exploitation, session sidejacking over HTTP, physical access to a logged-in browser, or stealing the "remember me" cookie. The vulnerability, identified as CVE-2026-40588, enables immediate and permanent account takeover. Users of blueprintUE are urged to upgrade to version 4.2.0 or later to mitigate this risk.

Attack Chain

1. Attacker gains unauthorized access to a user's authenticated session. This could occur via XSS exploitation on the blueprintUE platform.
2. Alternatively, the attacker performs session sidejacking over HTTP, intercepting the user's session cookie.
3. In another scenario, the attacker gains physical access to a logged-in browser session on the user's machine.
4. The attacker could also steal the user's "remember me" cookie, bypassing the need for active session hijacking.
5. The attacker navigates to the password change form at /profile/{slug}/edit/.
6. The attacker enters a new password and confirms it in the form.
7. Due to the missing current_password validation, the password change is accepted without verifying the user's existing password.
8. The account password is changed, resulting in complete account takeover, and the legitimate user is locked out.

Impact

Successful exploitation of CVE-2026-40588 leads to complete account takeover on the blueprintUE platform. An attacker can then access, modify, or delete sensitive data associated with the compromised account, potentially disrupting Unreal Engine development projects and accessing private assets. Given the nature of blueprintUE as a development tool, compromised accounts could be used to inject malicious code into Unreal Engine projects, leading to further compromise of end-user systems. While the exact number of potentially affected users is not specified, any blueprintUE user on a version prior to 4.2.0 is at risk.

Recommendation

• Immediately upgrade all blueprintUE installations to version 4.2.0 or later to patch CVE-2026-40588.
• Implement monitoring for unusual password change activity in web server logs, looking for requests to /profile/{slug}/edit/ without a current_password parameter (see example Sigma rule).
• If upgrading is not immediately possible, implement temporary mitigations such as multi-factor authentication (MFA) and strong session management controls to make session hijacking and cookie theft more difficult.
• Review web server logs for potential XSS attempts targeting blueprintUE users.