Indefinite Token Validity in blueprintUE Tool by BlueprintUE

CVE-2026-40585

What is CVE-2026-40585?

In blueprintUE, a tool designed for Unreal Engine developers, there exists a vulnerability prior to version 4.2.0 related to password reset functionality. When a user initiates a password reset, a token generated via a cryptographically secure random number generator (CSPRNG) is created and is stored alongside a timestamp indicating the reset request's time. The vulnerability arises as the function responsible for redeeming this token does not enforce a maximum validity period, thereby allowing a generated reset token to remain valid indefinitely. It is only invalidated when explicitly used or replaced by a new reset request, potentially exposing users to security risks.

References