---
id: CVE-2026-18639
title: >-
  When Velociraptor is configured to use an OIDC IdP for authentication, it uses
  the email claim as a username
summary: >-
  When Velociraptor is configured to use an OIDC IdP for authentication, it uses
  the email claim as a username. However, some IdP allow users to change the
  email claim without verification. Some IdPs do not set the "email_verified"
  claim a…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N'
cwe:
  - CWE-290
published: '2026-08-11'
updated: '2026-08-28'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18639'
references:
  - url: 'http://docs.velociraptor.app/announcements/advisories/cve-2026-18639/'
    label: cve@rapid7.com
tags:
  - nvd
epss: 0.00387
epssPercentile: 0.3009
ingestedAt: '2026-08-29T19:41:14.642Z'
---

## Overview

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email.

This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.