CVE-2026-18639

Name of the Vulnerable Software and Affected Versions Velociraptor (affected versions not specified)

Description When configured to use an OpenID Connect (OIDC) Identity Provider (IdP) for authentication, the software uses the email claim as the username. Because some IdPs allow users to modify the email claim without verification or fail to set the email verified claim, an attacker can impersonate another user by changing their email address within the IdP, leading to account takeover.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.