CVE-2026-18639 in Velociraptor
要約
〜によって MITRE • 2026年08月11日
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email.
This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.