PT-2026-34035 · Unknown · Blueprintue

Published 2026-04-21 · Updated 2026-04-21 · CVE-2026-40587

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions blueprintUE versions prior to 4.2.0

Description Changing a password through the profile edit page or completing a password reset via a reset link does not invalidate existing authenticated sessions. The server-side session store associates userID with a session, but the password update process only modifies the password column in the users table without destroying active sessions. Consequently, an attacker with a compromised session maintains account access until the session expires naturally, based on the SESSION GC MAXLIFETIME (defaulting to 86400 seconds) or SESSION LIFETIME configurations.

Recommendations Update to version 4.2.0.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-40587

Affected Products

Blueprintue

References · 4

• 🔥 https://github.com/blueprintue/blueprintue-self-hosted-edition/security/advisories/GHSA-gqpq-x62g-p4mg · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-40587 · Security Note
• https://twitter.com/CVEnew/status/2046675013747540334 · Twitter Post
• https://twitter.com/infoflowcloud/status/2046676539916329300 · Twitter Post