CVE-2026-18639 in Velociraptor
Summary
by MITRE • 08/11/2026
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email.
This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical authentication flaw in Velociraptor's OpenID Connect implementation that directly enables privilege escalation and unauthorized access. The system relies on the email claim from the identity provider as the primary username identifier without proper validation of the email's authenticity or ownership. When identity providers fail to enforce email verification mechanisms or do not set the email_verified claim, this creates an exploitable gap in the authentication pipeline where malicious actors can manipulate their email address within the identity provider's system to assume the identity of legitimate users.
The technical implementation flaw stems from Velociraptor's trust model which accepts user-provided email addresses without cryptographic verification or ownership confirmation. This pattern violates fundamental security principles for identity management and aligns with CWE-305 authentication bypass vulnerabilities where authentication relies on unverified user input. The vulnerability operates at the authentication layer and can be categorized under ATT&CK technique T1078 credential access, specifically targeting legitimate accounts through unauthorized access. When an attacker successfully changes their email address in the IdP to match another user's email, they effectively gain access to that user's privileges and data within Velociraptor's environment.
The operational impact of this vulnerability extends beyond simple account takeover to potentially enable lateral movement and persistent access within security operations environments. Since Velociraptor is commonly used for incident response, threat hunting, and security monitoring, an attacker who successfully impersonates a legitimate user gains access to sensitive security data, can execute privileged commands, and may remain undetected for extended periods. The vulnerability affects organizations that rely on third-party identity providers without proper validation of user identities, particularly those using IdPs that do not enforce email verification as part of their authentication flow.
Organizations should implement immediate mitigations including enforcing strict email verification requirements within their identity providers, configuring Velociraptor to validate the email_verified claim before accepting user identities, and implementing additional authentication factors such as multi-factor authentication. Security teams should also establish monitoring for unauthorized email changes within their IdP systems and consider implementing custom validation logic that cross-references user identities against known legitimate email addresses. The mitigation strategy should align with defense-in-depth principles and address the root cause by ensuring that only verified and authenticated email addresses are accepted as valid user identifiers in the authentication process.