CVE-2026-40586

blueprintUE: Login Endpoint Has No Rate Limiting, Lockout, or Brute-Force Protection

Published Apr 21, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the login form handler performs no throttling of any kind. Failed authentication attempts are processed at full network speed with no IP-based rate limiting, no per-account attempt counter, no temporary lockout, no progressive delay (Tarpit), and no CAPTCHA challenge. An attacker can submit an unlimited number of credential guesses. The password policy (10+ characters, mixed case, digit, special character) reduces the effective keyspace but does not prevent dictionary attacks, credential stuffing from breached databases, or targeted attacks against known users with predictable passwords. This vulnerability is fixed in 4.2.0.

Analysis

Technical impact

The login endpoint of blueprintUE Self‑Hosted Edition does not enforce any throttling, lockout, or brute‑force protection. An attacker may submit an unlimited number of authentication requests at full network speed. Without rate limiting, per‑account counters, or CAPTCHA challenges, attackers can perform dictionary or credential‑stuffing attacks against known or guessed user accounts. This weakness, identified by CWE-307, can lead to unauthorized access, credential theft, and potentially full compromise of the application and underlying systems.

Affected Systems

All installations of blueprintUE Self‑Hosted Edition running any version earlier than 4.2.0 are affected. The vulnerability was fixed in version 4.2.0 and later releases have built‑in rate limiting and lockout mechanisms.

Risk and Exploitability

The CVSS score is 7.5, indicating a high impact with reasonable exploitation complexity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers need only to send repeated credential attempts against the login endpoint, which is accessible over the network, making it a likely target for automated brute‑force tools.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

blueprintue

blueprintue-self-hosted-edition

affected

Version	Status	Constraints
`< 4.2.0`	affected	—

No data.

Vendor Product Versions

Blueprintue

Blueprintue-self-hosted-edition

Version	Status	Scheme	Platform
`[0,4.2.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to blueprintUE Self‑Hosted Edition 4.2.0 or later to gain built‑in throttling and lockout features.
If an upgrade is not immediately possible, deploy network‑level rate limiting or IP‑based blocking on the login service to reduce the request rate.
Apply additional challenges such as CAPTCHA or multi‑factor authentication to the login form.

Generated by OpenCVE AI on April 21, 2026 at 22:33 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.366% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-m6c2-6p3h-8jv2

History

Apr 22, 2026 12:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Blueprintue Blueprintue blueprintue-self-hosted-edition
Vendors & Products		Blueprintue Blueprintue blueprintue-self-hosted-edition

Apr 22, 2026 12:00 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 21, 2026 5:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the login form handler performs no throttling of any kind. Failed authentication attempts are processed at full network speed with no IP-based rate limiting, no per-account attempt counter, no temporary lockout, no progressive delay (Tarpit), and no CAPTCHA challenge. An attacker can submit an unlimited number of credential guesses. The password policy (10+ characters, mixed case, digit, special character) reduces the effective keyspace but does not prevent dictionary attacks, credential stuffing from breached databases, or targeted attacks against known users with predictable passwords. This vulnerability is fixed in 4.2.0.
Title		blueprintUE: Login Endpoint Has No Rate Limiting, Lockout, or Brute-Force Protection
Weaknesses		CWE-307
References		https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-m6c2-6p3h-8jv2
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`