CVE-2026-18639 PUBLISHED

Velociraptor OIDC Authenticator susceptible to email spoofing

Assigner: rapid7
Reserved: 03.08.2026 Published: 11.08.2026 Updated: 11.08.2026

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email.

This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS Score: 7.3

Product Status

Vendor Rapid7
Product Velociraptor
Versions Default: unaffected
  • affected from 0 to 0.77.2 (excl.)

Affected Configurations

Velociraptor must be configured to use an IdP which does not verify a user's email and allows the user to set their email. Examples include Azure IdP and Keycloak in self enrollment mode.

Workarounds

You can change the claim that Velociraptor uses as the username using the  Configuration File https://docs.velociraptor.app/docs/deployment/references/#GUI.authenticator.claims.username  . Set the username using a more permanent claim for example with Azure the "upn" or "oid" can not be chosen by the user.

Credits

  • Leonardo Souza (anauaque) finder

References

Problem Types

  • CWE-290 Authentication bypass by spoofing CWE

Impacts

  • CAPEC-22 Exploiting Trust in Client