CVE-2026-40586 blueprintUE: Login Endpoint Has No Rate Limiting, Lockout, or Brute-Force Protection
Attackers can perform unlimited brute-force attacks on login endpoints due to missing rate limiting, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40586?
CVE-2026-40586 is a high-severity missing authorization vulnerability in blueprintue-self-hosted-edition, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the login form handler performs no throttling of any kind. Failed authentication attempts are processed at full network speed with no IP-based rate limiting, no per-account attempt counter, no temporary lockout, no progressive delay (Tarpit), and no CAPTCHA challenge. An attacker can submit an unlimited number of credential guesses. The password policy (10+ characters, mixed case, digit, special character) reduces the effective keyspace but does not prevent dictionary attacks, credential stuffing from breached databases, or targeted attacks against known users with predictable passwords. This vulnerability is fixed in 4.2.0.
Weakness: CWE-307
Which versions are affected by CVE-2026-40586?
How do I fix CVE-2026-40586?
No fix has been published for CVE-2026-40586 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-40586 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40586 exists.
Sources
Also known as GHSA-m6c2-6p3h-8jv2.