CVE-2026-18639 | BDVDB-2026-357280 Detail
Rapid7Velociraptor
Description#
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email. This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.
Impact#
CAPEC-22 Exploiting Trust in Client
Weaknesses#
- CWE-290 Authentication bypass by spoofing
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.