CVE-2026-18639 — Velociraptor OIDC Authenticator susceptible to email spoofing
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without ver…
Published: 2026-08-11 · CVSS: 7.3 · CVSS 3.1
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email. This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7