Detections
Analytics
CVE-2026-18639
high
Description
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email. This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.
References
http://docs.velociraptor.app/announcements/advisories/cve-2026-18639/