CVE-2026-18639 in Velociraptor
الملخص
بحسب MITRE • 11/08/2026
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email.
This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.