# CVE-2024-29855: Recovery Orchestrator - Authentication Bypass

> Live exploitation tracking for CVE-2024-29855 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-29855

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.0
- **Public exploit available:** Yes
- **Affected products:** Veeam Recovery Orchestrator
- **Weaknesses:** CWE-798 (Use of Hard-coded Credentials)
- **Tags:** web_application, enterprise_software

## Description

Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator

## CrowdSec analysis

[CVE-2024-29855](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-29855) is a vulnerability caused hard-coded JWT secret in Veeam Recovery Orchestrator which leads to an authentication bypass, potentially allowing attackers to forge tokens and gain unauthorized access to sensitive information or system functions. This flaw could be exploited to compromise the integrity and confidentiality of orchestrated recovery operations.

CrowdSec has been tracking this vulnerability and its exploits since 1st of June 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-29855 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit CVE-2024-29855 by sending unauthenticated requests to the `/api/v0/login/getinitdata` endpoint, bypassing authentication controls using a forged JWT.

## Timeline

- 2024-06-11: CVE Published. CVE-2024-29855 is published to NVD.
- 2025-06-01: Rule Released. CrowdSec releases a rule to detect CVE-2024-29855 exploitation attempts against the CrowdSec Network.

## References

- https://www.veeam.com/kb4585

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-29855) follows observed exploitation activity for CVE-2024-29855. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.