CVE-2024-29855

CRITICAL

Veeam Recovery Orchestrator - Auth Bypass

Title source: llm

Description

Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator

Exploits (1)

nomisec WORKING POC 20 stars
by sinsinology · poc
https://github.com/sinsinology/CVE-2024-29855

References (1)

Scores

CVSS v3 9.0
EPSS 0.1946
EPSS Percentile 95.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Details

CWE
CWE-798
Status published
Products (1)
veeam/recovery_orchestrator < 7.0.0.379
Published Jun 11, 2024
Tracked Since Feb 18, 2026