EUVD-2026-51018
GHSA-r6vm-r9vq-cmwh
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Account takeover via stolen reset token constitutes both credential disclosure (C:H) and password modification (I:H); AC:H reflects victim-click dependency.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
1DescriptionCVE.org
Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to an attacker-controlled host, allowing the attacker to take over the account.
AnalysisAI
Password reset token hijacking in Veeam Service Provider Console 9.2 and earlier enables unauthenticated remote attackers to take over any portal user account by manipulating the returnUrl parameter in the Forgot Password workflow. An attacker who knows a target's email address initiates a password reset on their behalf, supplying an attacker-controlled domain via the unvalidated returnUrl parameter; the platform then generates a reset email whose link routes through the attacker's infrastructure, transmitting the one-time reset code upon the victim clicking it. Account takeover is achieved without requiring any credentials or prior access to the platform. No public exploit has been identified at time of analysis, and CISA KEV status is not confirmed; however, the technique is straightforward and the report originated from HackerOne, suggesting the attack vector is well-understood by researchers.
Technical ContextAI
Veeam Service Provider Console (CPE: cpe:2.3:a:veeam:service_provider_console:*:*:*:*:*:*:*:*) is a multi-tenant management plane used by managed service providers and cloud service providers to administer Veeam backup infrastructure on behalf of customers. The root cause is CWE-640 (Weak Password Recovery Mechanism for Forgotten Password), a class of vulnerability in which a password reset flow accepts and uses attacker-supplied parameters to construct the reset URL without validation. Specifically, the Forgot Password endpoint does not validate or restrict the returnUrl query parameter, allowing the attacker to substitute an arbitrary external domain for the legitimate VSPC hostname. The reset token is consequently embedded in a URL pointing to attacker-controlled infrastructure rather than the Veeam portal, and is exfiltrated the moment the victim visits that URL. This is distinct from a traditional open redirect (CWE-601); the critical difference is that the reset code - a single-use credential equivalent - is appended to the attacker's domain, enabling full account compromise rather than mere phishing redirection.
RemediationAI
Apply the patch identified in Veeam's knowledge base article KB4853 (https://www.veeam.com/kb4853), which addresses the unvalidated returnUrl handling in the Forgot Password function. The exact minimum safe version should be confirmed from that advisory, as it was not independently available in the data used for this analysis. As a compensating control where immediate patching is not possible, network-layer restrictions can reduce exposure: limit access to the VSPC web portal to trusted IP ranges or a VPN, preventing an unauthenticated external attacker from initiating a reset request on behalf of internal users. Additionally, email security gateways or user awareness training can help reduce the likelihood that a targeted user clicks a suspicious reset link originating from an unexpected or unfamiliar domain. Be aware that IP-restricting the portal may impact legitimate remote administrator access and should be scoped carefully in MSP environments where portal access is geographically distributed.
More in Service Provider Console
View allCredential theft via agent impersonation in Veeam Service Provider Console (VSPC) allows a remote, unauthenticated attac
Remote code execution in Veeam Service Provider Console versions 9.0 through 9.2 allows authenticated remote attackers t
Arbitrary file write in Veeam Service Provider Console (VSPC) lets an authenticated, low-privileged remote attacker plan
Memory exhaustion in Veeam Service Provider Console (VSPC) allows unauthenticated remote attackers to deplete host memor
Unauthenticated Portal Administrator impersonation in Veeam Service Provider Console (VSPC) exposes the proxied applianc
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today