CVE-2026-18639
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Summary
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email.
This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Rapid7 | Velociraptor | 0 < 0.77.2 | affected |
Weaknesses
- CWE-290: CWE-290 Authentication bypass by spoofing
Workarounds
You can change the claim that Velociraptor uses as the username using the Configuration File https://docs.velociraptor.app/docs/deployment/references/#GUI.authenticator.claims.username . Set the username using a more permanent claim for example with Azure the "upn" or "oid" can not be chosen by the user.
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.