The vulnerability in Veeam Service Provider Console's Forgot Password function stems from improper validation of the returnUrl parameter. An unauthenticated attacker can craft a password reset link that directs the reset code to a domain they control. When the victim clicks this link, the attacker receives the reset code, allowing them to take over the victim's account. This issue is identified as CVE-2026-64635 and is associated with CWE-640 (Improper Authorization). The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact. There is no information on affected versions or available patches.

Successful exploitation allows an unauthenticated attacker to hijack user accounts by intercepting password reset codes. This compromises account confidentiality but does not affect integrity or availability. The attack requires user interaction (clicking the malicious link) and has a high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users and administrators should exercise caution with password reset links, verifying the domain before clicking. Monitor vendor communications for updates on patches or official mitigations.