CVE-2026-64635: Veeam Console Auth Bypass Vulnerability

CVE-2026-64635 Overview

CVE-2026-64635 affects the Veeam Service Provider Console and stems from improper handling of the returnUrl parameter in the Forgot Password function. An unauthenticated attacker can control the domain used to build the password reset link that Veeam delivers by email. When the targeted user clicks the crafted link, the password reset code is transmitted to an attacker-controlled host. The attacker can then submit the intercepted code and take over the victim's account. The weakness falls under CWE-640: Weak Password Recovery Mechanism for Forgotten Password.

Critical Impact
A successful attack results in full account takeover of a Veeam Service Provider Console user without prior authentication, provided the victim interacts with the poisoned reset email.

Affected Products

Veeam Service Provider Console (Forgot Password function)
Refer to the Veeam Knowledge Base Article for the authoritative list of affected versions
Deployments exposing the Forgot Password endpoint to the internet

Discovery Timeline

2026-07-30 - CVE-2026-64635 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64635

Vulnerability Analysis

The Veeam Service Provider Console exposes a Forgot Password workflow that accepts a returnUrl parameter from the requester. The application uses that parameter when constructing the password reset link embedded in the outbound email. Because the value is not validated against an allowlist of trusted domains, an attacker can submit a reset request for a legitimate user while supplying a returnUrl pointing to a host they control.

The victim receives an email that originates from the legitimate Veeam Service Provider Console instance and appears trustworthy. Clicking the link sends the reset code to the attacker's endpoint through the URL path, query string, or referer chain. The attacker then replays that code against the real console to complete the password reset and hijack the account. Exploitation requires user interaction, which is reflected in the attack complexity of the issue.

Root Cause

The root cause is missing validation of the returnUrl parameter within the password recovery flow [CWE-640]. The application treats attacker-supplied input as trusted when building the reset URL, allowing host substitution in the delivered link.

Attack Vector

The attack is network-based and unauthenticated. An attacker sends a crafted Forgot Password request that specifies a target account and a malicious returnUrl. The victim must click the resulting email link for the reset code to leak. See the Veeam Knowledge Base Article for vendor-provided technical details.

Detection Methods for CVE-2026-64635

Indicators of Compromise

Outbound password reset emails containing links whose host does not match the canonical Veeam Service Provider Console FQDN.
Web server or reverse proxy logs showing Forgot Password requests with a returnUrl parameter referencing external or unexpected domains.
Password reset completions immediately followed by login sessions from unfamiliar IP addresses or user agents.

Detection Strategies

Inspect application and proxy logs for anomalous values in the returnUrl parameter submitted to the Forgot Password endpoint.
Correlate password reset events with subsequent authentication events to flag resets followed by logins from new geographies or devices.
Alert on bursts of Forgot Password submissions targeting privileged Veeam Service Provider Console accounts.

Monitoring Recommendations

Forward web server, reverse proxy, and mail gateway logs to a centralized analytics platform for correlation.
Monitor mail flow for outbound reset messages containing embedded URLs whose domain differs from the console's approved hostnames.
Track account lockouts, password changes, and privilege modifications on Veeam Service Provider Console user accounts.

How to Mitigate CVE-2026-64635

Immediate Actions Required

Apply the fixed Veeam Service Provider Console build referenced in the Veeam Knowledge Base Article.
Restrict network exposure of the Forgot Password endpoint to trusted networks or a VPN where operationally feasible.
Notify administrators to disregard reset emails whose embedded link does not match the sanctioned console domain.
Force password rotation and review recent reset activity for privileged accounts.

Patch Information

Veeam has published guidance and remediation details in the Veeam Knowledge Base Article KB4853. Administrators should upgrade to the fixed release identified in that advisory and verify that the Forgot Password workflow now validates the returnUrl parameter against an allowlist.

Workarounds

Place the Veeam Service Provider Console behind a reverse proxy that strips or rewrites the returnUrl parameter on requests to the Forgot Password endpoint.
Enforce multi-factor authentication so that a stolen reset code alone cannot complete account takeover.
Educate users to verify link domains before clicking password reset messages, and to report mismatches to the security team.

bash

# Example reverse proxy rule to strip returnUrl on the Forgot Password endpoint (NGINX)
location /forgot-password {
    if ($arg_returnUrl) {
        return 302 /forgot-password;
    }
    proxy_pass https://veeam-spc-backend;
}