blueprintUE provides a 128‑character cryptographically secure token when a user requests a password reset. The token redemption function verifies only the email–token pair and ignores the timestamp that records when the token was created. The token therefore remains valid indefinitely until it is consumed or overwritten by a later reset request. An attacker who learns or otherwise obtains a valid token can reset the targeted account’s password at any time, effectively taking over that account and compromising its data and services. This flaw represents a credential compromise weakness identified as CWE‑640.

The vulnerability exists in blueprintue self‑hosted editions prior to version 4.2.0. Any installation that has not applied the 4.2.0 update or later is affected.

The CVSS score of 7.4 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that an attacker who obtains a reset token could use it at any time to reset the associated account because the token never expires. Attackers may acquire the token through social engineering, email interception, or other means. Because the window of exploitation is effectively unlimited, the risk is significant for any user with an active account. This vulnerability is considered high risk and should be addressed promptly.