Account Takeover Risk in BlueprintUE Tool for Unreal Engine Developers

CVE-2026-40588

What is CVE-2026-40588?

BlueprintUE, a tool designed for Unreal Engine developers, contains a significant vulnerability in its password change functionality prior to version 4.2.0. The absence of a 'current_password' field allows malicious actors, who have already gained unauthorized access through methods like XSS, session hijacking, or physical access, to change the user's password without requiring the original password. This flaw can lead to irreversible account takeovers, posing serious security risks to developers relying on this tool. Users are urged to upgrade to version 4.2.0 or later to mitigate this vulnerability.

References