Unreal Engine Tool's Login Flaw Exposes Developers to Brute-Force Attacks

The National Vulnerability Database has identified CVE-2026-40586, a critical vulnerability in blueprintUE, a tool designed for Unreal Engine developers. Versions prior to 4.2.0 lack any form of authentication throttling on their login handler. This means attackers can attempt an unlimited number of password guesses without any IP-based rate limiting, account lockouts, or CAPTCHA challenges. While strong password policies can mitigate some risks, they do not prevent brute-force, dictionary, or credential stuffing attacks against this unchecked login mechanism.

The CVSS score of 7.5 (HIGH) highlights the severity of this flaw. The absence of protective measures allows for unrestricted credential stuffing and brute-force attempts, potentially leading to account compromise for Unreal Engine developers. This vulnerability, classified under CWE-307, directly impacts the security posture of developers relying on blueprintUE for their workflow.