THREAT OPS › Threat News › [NVD] CVE-2026-18639 (HIGH 7.3) — When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email.
This
[NVD] CVE-2026-18639 (HIGH 7.3) — When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email. This
CVE-2026-18639 CVSS: 7.3 HIGH Published: 2026-08-11T16:17:30.590
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email.
This allows a user to impersonate another user by setting t
Indicators of compromise
- CVE-2026-18639cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-18639