CVE-2026-18972 — Velociraptor authenticated identity-spoofing vulnerability
An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an account takeover atta…
Published: 2026-08-11 · CVSS: 9.6 · CVSS 3.1
An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header \"Grpc-Metadata-USER\". This can lead to an account takeover attack from a user with low privileges to administrator.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7