CVE-2026-40586

{
  "id": "CVE-2026-40586",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-21T17:16:56.523",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the login form handler performs no throttling of any kind. Failed authentication attempts are processed at full network speed with no IP-based rate limiting, no per-account attempt counter, no temporary lockout, no progressive delay (Tarpit), and no CAPTCHA challenge. An attacker can submit an unlimited number of credential guesses. The password policy (10+ characters, mixed case, digit, special character) reduces the effective keyspace but does not prevent dictionary attacks, credential stuffing from breached databases, or targeted attacks against known users with predictable passwords. This vulnerability is fixed in 4.2.0."
    },
    {
      "lang": "es",
      "value": "blueprintUE es una herramienta para ayudar a los desarrolladores de Unreal Engine. Antes de la versión 4.2.0, el gestor del formulario de inicio de sesión no realiza ningún tipo de limitación. Los intentos de autenticación fallidos se procesan a máxima velocidad de red sin limitación de velocidad basada en IP, sin contador de intentos por cuenta, sin bloqueo temporal, sin retardo progresivo (’Tarpit’) y sin desafío CAPTCHA. Un atacante puede enviar un número ilimitado de intentos de credenciales. La política de contraseñas (más de 10 caracteres, mayúsculas y minúsculas, dígito, carácter especial) reduce el espacio de claves efectivo, pero no evita los ataques de diccionario, el relleno de credenciales de bases de datos comprometidas o los ataques dirigidos contra usuarios conocidos con contraseñas predecibles. Esta vulnerabilidad está corregida en la versión 4.2.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "blueprintue",
          "product": "blueprintue-self-hosted-edition",
          "versions": [
            {
              "version": "< 4.2.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-21T19:04:12.732330Z",
          "id": "CVE-2026-40586",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-307"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-m6c2-6p3h-8jv2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-m6c2-6p3h-8jv2",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}