CVE-2026-18639

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email. This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.1 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://docs.velociraptor.app/announcements/advisories/cve-2026-18639/

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Cuyo Velociraptor está configurado para usar un IdP OIDC para autenticación, utiliza la declaración de correo electrónico como nombre de usuario. Sin embargo, algunos IdP permiten a los usuarios cambiar la declaración de correo electrónico sin verificación. Algunos IdP no establecen la declaración ’email_verified’ y en realidad no verifican el correo electrónico. Esto permite a un usuario suplantar a otro usuario al establecer su dirección de correo electrónico dentro del IdP, lo que permite la toma de control de la cuenta.

Information

Published : 2026-08-11 16:17

Updated : 2026-10-23 19:10

NVD link : CVE-2026-18639

Mitre link : CVE-2026-18639

CVE.ORG link : CVE-2026-18639

JSON object : View

Products Affected

No product.

CWE

CWE-290

Authentication Bypass by Spoofing

{"id": "CVE-2026-18639", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18639", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-11T17:13:54.338948Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@rapid7.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.1}]}, "affected": [{"source": "cve@rapid7.com", "affectedData": [{"repo": "https://github.com/Velocidex/velociraptor/", "vendor": "Rapid7", "product": "Velociraptor", "versions": [{"status": "affected", "version": "0", "lessThan": "0.77.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-11T16:17:30.590", "references": [{"url": "http://docs.velociraptor.app/announcements/advisories/cve-2026-18639/", "source": "cve@rapid7.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve@rapid7.com", "description": [{"lang": "en", "value": "CWE-290"}]}], "descriptions": [{"lang": "en", "value": "When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the \"email_verified\" claim and do not actually verify the email.\n\nThis allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover."}, {"lang": "es", "value": "Cuyo Velociraptor est\u00e1 configurado para usar un IdP OIDC para autenticaci\u00f3n, utiliza la declaraci\u00f3n de correo electr\u00f3nico como nombre de usuario. Sin embargo, algunos IdP permiten a los usuarios cambiar la declaraci\u00f3n de correo electr\u00f3nico sin verificaci\u00f3n. Algunos IdP no establecen la declaraci\u00f3n \u2019email_verified\u2019 y en realidad no verifican el correo electr\u00f3nico.\n\nEsto permite a un usuario suplantar a otro usuario al establecer su direcci\u00f3n de correo electr\u00f3nico dentro del IdP, lo que permite la toma de control de la cuenta."}], "lastModified": "2026-10-23T19:10:00.167", "sourceIdentifier": "cve@rapid7.com"}