EUVD-2026-56187
GHSA-7v2v-mhwj-r9rw
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
AC:H because exploitation requires an IdP that permits unverified email changes, a non-universal condition; UI:N because no victim interaction is required; PR:L for mandatory IdP account.
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email.
This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.
AnalysisAI
Account takeover in Rapid7 Velociraptor is possible when the platform is configured to use an external OIDC Identity Provider for authentication. Velociraptor maps OIDC email claims directly to internal usernames without validating the IdP's email_verified flag, enabling an attacker with any account on the same IdP to change their registered email address to match a target user's and seamlessly inherit that user's Velociraptor session and privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) Velociraptor must be explicitly configured to use an external OIDC Identity Provider for authentication - this is a non-default deployment choice that must be intentionally enabled by an administrator; (2) the attacker must hold a valid account on the same IdP instance that Velociraptor is configured to trust, making this an insider or shared-tenant threat scenario; and (3) the IdP must either permit users to self-service change their email address without re-verification, or omit the email_verified claim from OIDC tokens entirely. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N scores 7.3 (High), but several metrics warrant scrutiny. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with an existing account on the same OIDC IdP (e.g., an Okta tenant shared with the target organization) navigates to the IdP's profile settings and changes their email address to match a known Velociraptor administrator's email - such as an IR lead's address discovered via LinkedIn or a data breach. The IdP, which permits email changes without re-verification, issues an OIDC token bearing the target's email claim. … |
| Remediation | Consult the Rapid7 vendor advisory at http://docs.velociraptor.app/announcements/advisories/cve-2026-18639/ for the patched release version, which was not independently confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Begin immediate inventory of all Velociraptor deployments configured with OIDC authentication and document current user access levels and privileges (complete within 24 hours). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Velociraptor
View allPrivilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIEN
Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-pr
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role
Rapid7 Velociraptor allows users to be created with different privileges on the server. Rated high severity (CVSS 8.8),
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any
Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious me
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, e
We need to produce a JSON object with all specified fields, based on provided data. The CVE is CVE-2026-6290, about Velo
Cross-organization ACL disclosure in Velocidex Velociraptor before 0.76.5 allows any authenticated low-privilege user to
Out-of-bounds read and memory exhaustion flaws in Velociraptor's NTFS parsing library allow denial of service when proce
Path traversal in Velociraptor's NewNotebook API allows authenticated users holding NOTEBOOK_EDIT permission to write fi
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today