In blueprintue-self-hosted-edition versions before 4.2.0, the password reset process generates a secure token and stores it with a timestamp. The function that validates the token and email pair does not check whether the token has expired based on the timestamp, resulting in tokens that remain valid indefinitely until consumed or overwritten. This weak password recovery mechanism (CWE-640) can be exploited to reset passwords using old tokens. The vulnerability is resolved in version 4.2.0.

An attacker who obtains a valid password reset token can use it at any time to reset the password because the system does not enforce expiration of the token. This can lead to unauthorized account access and compromise of user credentials. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS score of 7.4 reflects a high severity due to network attack vector, high impact on confidentiality and integrity, and no privileges or user interaction required.

Upgrade blueprintue-self-hosted-edition to version 4.2.0 or later, where the password reset token expiration check is properly implemented. Until upgraded, consider invalidating outstanding password reset tokens manually if possible. Patch status is not explicitly stated but the vendor fixed the issue in version 4.2.0, so applying this official fix is the recommended remediation.