blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a password reset is initiated, a 128-character CSPRNG token is generated and stored…

blueprintUE, a tool for Unreal Engine developers, contains a vulnerability in versions prior to 4.2.0 where password reset tokens remain valid indefinitely. The token redemption function findUserIDFromEmailAndToken() only checks for matching email and token pairs but fails to validate the password_reset_at timestamp against a maximum time window. Generated reset tokens persist until explicitly consumed or overwritten by subsequent reset requests. This creates a security risk where old reset tokens could potentially be exploited. The vulnerability has been addressed in version 4.2.0.