A vulnerability exists where an unauthenticated attacker can forge a federation token to circumvent REST API authentication. By doing so the attacker receives responses from API endpoints that do not invoke the Veeam Backup for Microsoft 365 backup service. The result is that an attacker can access protected API functionality without valid credentials, potentially exposing sensitive configuration data or enabling further exploitation of the system.

The issue affects installations of Veeam Backup for Microsoft 365 that expose REST API endpoints. No specific version information is provided, so any deployment of this product is considered vulnerable until a patch is applied.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV. The likely attack vector is an unauthenticated user forging a federation token over the network with access to the REST API. Because authentication is bypassed, exploitation requires only network connectivity and the ability to craft a forged token, making the risk moderate to high in environments where the API is publicly accessible.