CVE-2026-64635

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64635", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-07-20T15:00:00.696Z", "datePublished": "2026-07-30T06:02:49.984Z", "dateUpdated": "2026-07-30T12:44:36.592Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to an attacker-controlled host, allowing the attacker to take over the account."}], "affected": [{"defaultStatus": "unaffected", "vendor": "Veeam", "product": "Service Provider Console", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "9.2", "versionType": "semver"}]}], "references": [{"url": "https://www.veeam.com/kb4853"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-640", "description": "CWE-640 Weak Password Recovery Mechanism for Forgotten Password"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-07-30T06:02:49.984Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-30T12:43:16.597837Z", "id": "CVE-2026-64635", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-30T12:44:36.592Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64635", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-30T12:43:16.597837Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-30T12:43:41.415Z"}}], "cna": {"metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "Veeam", "product": "Service Provider Console", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "9.2"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.veeam.com/kb4853"}], "descriptions": [{"lang": "en", "value": "Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to an attacker-controlled host, allowing the attacker to take over the account."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-640", "description": "CWE-640 Weak Password Recovery Mechanism for Forgotten Password"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-07-30T06:02:49.984Z"}}}, "cveMetadata": {"cveId": "CVE-2026-64635", "state": "PUBLISHED", "dateUpdated": "2026-07-30T12:44:36.592Z", "dateReserved": "2026-07-20T15:00:00.696Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2026-07-30T06:02:49.984Z", "assignerShortName": "hackerone"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Service Provider Console", "vendor": "Veeam", "versions": [{"lessThanOrEqual": "9.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "support@hackerone.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to an attacker-controlled host, allowing the attacker to take over the account."}, {"lang": "es", "value": "Manejo inadecuado del par\u00e1metro returnUrl en la funci\u00f3n Olvid\u00e9 mi contrase\u00f1a de Veeam Service Provider Console permite a un atacante no autenticado controlar el dominio del enlace de restablecimiento de contrase\u00f1a generado. Cuando el usuario objetivo hace clic en el enlace entregado por correo electr\u00f3nico, el c\u00f3digo de restablecimiento se transmite a un host controlado por el atacante, permitiendo al atacante tomar el control de la cuenta."}], "id": "CVE-2026-64635", "lastModified": "2026-10-23T22:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "support@hackerone.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64635", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-30T12:43:16.597837Z", "version": "2.0.3"}}]}, "published": "2026-07-30T06:25:59.930", "references": [{"source": "support@hackerone.com", "url": "https://www.veeam.com/kb4853"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-640"}], "source": "support@hackerone.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,9.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Service Provider Console", "source": "cna", "vendor": "Veeam"}, "product": "service_provider_console", "vendor": "veeam"}], "created": "2026-07-30T08:00:13.469519+00:00", "title": "Return URL Manipulation in Veeam Service Provider Console Enables Password Reset Token Theft", "updated": "2026-08-03T11:15:04.013881+00:00", "vendors": ["veeam", "veeam$PRODUCT$service_provider_console"]}