CVE-2026-40587 blueprintUE: Active Sessions Are Not Invalidated After Password Change or Reset
Attackers with compromised sessions retain account access indefinitely after password changes because active sessions are not invalidated.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40587?
CVE-2026-40587 is a medium-severity vulnerability in blueprintue-self-hosted-edition, published on 21 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a user changes their password via the profile edit page, or when a password reset is completed via the reset link, neither operation invalidates existing authenticated sessions for that user. A server-side session store associates userID → session; the current password change/reset flow updates only the password column in the users table and does not destroy or mark invalid any active sessions. As a result, an attacker who has already compromised a session retains full access to the account indefinitely — even after the legitimate user has detected the intrusion and changed their password — until the session's natural expiry time (configured as SESSION_GC_MAXLIFETIME, defaulting to 86400 seconds / 24 hours, with SESSION_LIFETIME=0 meaning persistent until browser close or GC, whichever is later). This vulnerability is fixed in 4.2.0.
Weakness: CWE-613
Which versions are affected by CVE-2026-40587?
How do I fix CVE-2026-40587?
No fix has been published for CVE-2026-40587 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-40587 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40587 exists.
Sources
Also known as GHSA-gqpq-x62g-p4mg.