docs.velociraptor.app
http://docs.velociraptor.app/announcements/advisories/cve-2026-18639 CVE-2026-18639
HIGH
Velociraptor OIDC Authenticator susceptible to email spoofing
Record summary
CVE-2026-18639 has a selected CVSS score of 7.3 (high).
Description
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email. This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 11, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
VelociraptorBrowse Rapid7 / VelociraptorDefault status: unaffected | CVE List | Before 0.77.2 | affected |
References
2nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-18639