CVE-2026-18639: RAPID7 Velociraptor

High severity, CVSS 7.3. EPSS: 0.4% chance of exploitation in the next 30 days.

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email. This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.

Affected products

• RAPID7 Velociraptor: before 0.77.2 (fixed in 0.77.2)

Published 2026-08-11. Last modified 2026-08-28.