CVE-2026-18639
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdPs allow users to change the email claim without verification, and some do not set the "email_verified" claim. This allows a user to impersonate another user by setting their email address within the IdP, enabling account takeover.
Risk Assessment
The risk includes potential account takeover, leading to unauthorized access to data and resources. It may also compromise system integrity and confidentiality.
Recommendation
Configure the IdP to verify email addresses and set the "email_verified" claim. Consider using a different user identifier, such as sub, instead of email.
Original NVD description (English source)
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email. This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.