CVE-2026-64635CWE-640

CVE-2026-64635

Medium · published July 30, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
20.5
In the wild
Unconfirmed
What it is

Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to an attacker-controlled host, allowing the attacker to take over the account.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00291 · 20.5th percentile
Weakness
CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
Published
2026-07-30T10:25Z
References (1)
https://www.veeam.com/kb4853 · [email protected]
EPSS history
Timeline
  • 30 JUL 06:02Z
    Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control…
    cvelistv5