{"id":"CVE-2026-18639","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-18639","summary":"When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification.…","details":"When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the \"email_verified\" claim and do not actually verify the email.\n\nThis allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.","published":"2026-08-11T16:17:30.590","modified":"2026-08-11T16:17:30.590","cvss":{"score":7.3,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"http://docs.velociraptor.app/announcements/advisories/cve-2026-18639/"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-08-11T16:17:30.590"}}