CVE-2026-18639 — Velociraptor OIDC Authenticator susceptible to email spoofing

CVE-2026-18639

Velociraptor OIDC Authenticator susceptible to email spoofing PUBLISHED

Description (CNA)

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email. This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.

Affected (CNA)

Vendor / product	Versions
Rapid7 / Velociraptor	affected 0 before 0.77.2

CWE

CWE-290

References

http://docs.velociraptor.app/announcements/advisories/cve-2026-18639/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.