EUVD-2026-24203Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
6DescriptionGitHub Advisory
blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a user changes their password via the profile edit page, or when a password reset is completed via the reset link, neither operation invalidates existing authenticated sessions for that user. A server-side session store associates userID → session; the current password change/reset flow updates only the password column in the users table and does not destroy or mark invalid any active sessions. As a result, an attacker who has already compromised a session retains full access to the account indefinitely - even after the legitimate user has detected the intrusion and changed their password - until the session's natural expiry time (configured as SESSION_GC_MAXLIFETIME, defaulting to 86400 seconds / 24 hours, with SESSION_LIFETIME=0 meaning persistent until browser close or GC, whichever is later). This vulnerability is fixed in 4.2.0.
AnalysisAI
blueprintUE prior to version 4.2.0 fails to invalidate active user sessions when passwords are changed or reset, allowing attackers with compromised sessions to maintain indefinite account access even after the legitimate user detects the breach and changes their password. The attacker retains full account privileges until the session naturally expires (default 24 hours) or is manually cleared, creating a critical window where password changes provide no security benefit.
Technical ContextAI
blueprintUE uses a server-side session store that maps userID to active sessions, with session lifetime governed by PHP configuration parameters SESSION_GC_MAXLIFETIME (default 86400 seconds) and SESSION_LIFETIME. The vulnerability stems from insufficient session management during credential updates: the password change and reset operations update only the password column in the users database table without invalidating or marking invalid the corresponding sessions in the session store. This is a classic session fixation variant where session tokens remain valid despite credential rotation. The root cause is insufficient access control and authentication token management (CWE-613), allowing continued use of old session identifiers despite new credentials.
RemediationAI
Upgrade blueprintUE to version 4.2.0 or later, which implements session invalidation on password change and reset operations. For environments unable to upgrade immediately, implement compensating controls: enforce short session lifetimes by setting SESSION_GC_MAXLIFETIME to 3600 seconds (1 hour) or lower in the application configuration, reducing the exploitation window; deploy a manual session termination feature allowing administrators to force logout of all sessions for a user account via the admin panel; monitor session activity logs for continued access after password changes and flag anomalous patterns; implement IP-based session binding so that session tokens become invalid if the request source IP changes unexpectedly (trading flexibility for security). These mitigations reduce but do not eliminate the risk and should be considered temporary pending patching. Reference: GitHub Security Advisory GHSA-gqpq-x62g-p4mg at https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-gqpq-x62g-p4mg.
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today