Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS scores by FIRST (EPSS SIG), generated by Empirical Security. Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-40585 is a high-severity Weak Password Recovery Mechanism for Forgotten Password (CWE-640) vulnerability. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-12 (Identity Proofing) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-40585 affects blueprintUE, a self-hosted tool for Unreal Engine developers, in versions prior to 4.2.0. The vulnerability lies in the password reset mechanism, where a 128-character cryptographically secure pseudorandom number generator (CSPRNG) token is generated and stored with a password_reset_at timestamp upon reset initiation. However, the token redemption function, findUserIDFromEmailAndToken(), only verifies a matching email and token pair without checking if the timestamp has exceeded any expiration window. As a result, reset tokens remain valid indefinitely until consumed or overwritten by a new reset request. This issue, classified under CWE-640 (Weak Password Recovery Mechanism for Forgotten Password), carries a CVSS v3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) and was published on 2026-04-21.
An attacker with network access can exploit this vulnerability without privileges or user interaction, though it requires high attack complexity. Exploitation typically involves obtaining a victim's reset token—such as through phishing to trigger a reset and capture the token from email or other delivery methods—followed by redeeming it at any time with the victim's email address. Successful redemption allows the attacker to reset the victim's password, achieving high-impact confidentiality and integrity violations, such as unauthorized account access and potential control over the victim's blueprintUE instance.
The GitHub security advisory for blueprintUE-self-hosted-edition (GHSA-qr65-6vp8-whjf) confirms the issue is fixed in version 4.2.0, recommending immediate upgrades to mitigate the vulnerability. No additional workarounds are specified in available references.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24181
Vulnerability Data
blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a password reset is initiated, a 128-character CSPRNG token is generated and stored alongside a password_reset_at timestamp. However, the token redemption function findUserIDFromEmailAndToken() queries only for a…
more
matching email + password_reset token pair — it does not check whether the password_reset_at timestamp has elapsed any maximum window. A generated reset token is valid indefinitely until it is explicitly consumed or overwritten by a subsequent reset request. This vulnerability is fixed in 4.2.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Identity proofing at appropriate assurance levels ensures forgotten-password recovery cannot succeed without strong verification of the user.
Authenticator management requires secure distribution, reset, and verification procedures that directly address weak password recovery flows.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Credential lifecycle management directly includes password reset/recovery flows.
Identity proofing is the core control that prevents weak or bypassed recovery mechanisms.
Authentication policy covers strength/MFA but does not address recovery path weaknesses.
Secure SDLC reduces implementation flaws but is not specific to password-recovery design.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure-coding standards can prevent weak recovery implementations, yet the control is wider in scope.