When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email.
This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.
Velociraptor must be configured to use an IdP which does not verify a user's email and allows the user to set their email. Examples include Azure IdP and Keycloak in self enrollment mode.
You can change the claim that Velociraptor uses as the username using the Configuration File https://docs.velociraptor.app/docs/deployment/references/#GUI.authenticator.claims.username . Set the username using a more permanent claim for example with Azure the "upn" or "oid" can not be chosen by the user.