CVE-2026-64635

Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to an attacker-controlled host, allowing the attacker to take over the account.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.veeam.com/kb4853

Configurations

No configuration.

History

23 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Manejo inadecuado del parámetro returnUrl en la función Olvidé mi contraseña de Veeam Service Provider Console permite a un atacante no autenticado controlar el dominio del enlace de restablecimiento de contraseña generado. Cuando el usuario objetivo hace clic en el enlace entregado por correo electrónico, el código de restablecimiento se transmite a un host controlado por el atacante, permitiendo al atacante tomar el control de la cuenta.

Information

Published : 2026-07-30 06:25

Updated : 2026-10-23 22:10

NVD link : CVE-2026-64635

Mitre link : CVE-2026-64635

CVE.ORG link : CVE-2026-64635

JSON object : View

Products Affected

No product.

CWE

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

{"id": "CVE-2026-64635", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64635", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-30T12:43:16.597837Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "affected": [{"source": "support@hackerone.com", "affectedData": [{"vendor": "Veeam", "product": "Service Provider Console", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "9.2"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-30T06:25:59.930", "references": [{"url": "https://www.veeam.com/kb4853", "source": "support@hackerone.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "support@hackerone.com", "description": [{"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to an attacker-controlled host, allowing the attacker to take over the account."}, {"lang": "es", "value": "Manejo inadecuado del par\u00e1metro returnUrl en la funci\u00f3n Olvid\u00e9 mi contrase\u00f1a de Veeam Service Provider Console permite a un atacante no autenticado controlar el dominio del enlace de restablecimiento de contrase\u00f1a generado. Cuando el usuario objetivo hace clic en el enlace entregado por correo electr\u00f3nico, el c\u00f3digo de restablecimiento se transmite a un host controlado por el atacante, permitiendo al atacante tomar el control de la cuenta."}], "lastModified": "2026-10-23T22:10:00.160", "sourceIdentifier": "support@hackerone.com"}