Leonardo Souza

**Name of the Vulnerable Software and Affected Versions** Velociraptor (affected versions not specified) **Description** When configured to use an OpenID Connect (OIDC) Identity Provider (IdP) for authentication, the software uses the email claim as the username. Because some IdPs allow users to modify the email claim without verification or fail to set the `email verified` claim, an attacker can impersonate another user by changing their email address within the IdP, leading to account takeover. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.