EUVD-2026-56187
GHSA-7v2v-mhwj-r9rw
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
AC:H because exploitation requires an IdP that permits unverified email changes, a non-universal condition; UI:N because no victim interaction is required; PR:L for mandatory IdP account.
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (rapid7).
CVSS VectorVendor: rapid7
Lifecycle Timeline
3DescriptionCVE.org
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email.
This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.
AnalysisAI
Account takeover in Rapid7 Velociraptor is possible when the platform is configured to use an external OIDC Identity Provider for authentication. Velociraptor maps OIDC email claims directly to internal usernames without validating the IdP's email_verified flag, enabling an attacker with any account on the same IdP to change their registered email address to match a target user's and seamlessly inherit that user's Velociraptor session and privileges. Given Velociraptor's role as a DFIR and endpoint monitoring platform, successful exploitation could expose sensitive forensic data, endpoint telemetry, and incident response artifacts. No public exploit code has been identified at time of analysis.
Technical ContextAI
Velociraptor (cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*) is Rapid7's open-source digital forensics and incident response (DFIR) platform, commonly deployed in enterprise SOCs and IR teams for endpoint telemetry collection and threat hunting. When configured to delegate authentication to an external OIDC Identity Provider - such as Okta, Azure AD, Google Workspace, or Keycloak - Velociraptor extracts the email claim from the OIDC ID token and uses it verbatim as the local username for session establishment. CWE-290 (Authentication Bypass by Spoofing) applies precisely here: the application performs identity resolution based on a spoofable attribute without enforcing the email_verified claim that OIDC specifies to indicate verified ownership. Because some IdPs permit users to update their registered email without re-verification, and because other IdPs omit the email_verified field entirely, Velociraptor cannot distinguish a legitimately owned email from one that has been opportunistically set to match a target account.
RemediationAI
Consult the Rapid7 vendor advisory at http://docs.velociraptor.app/announcements/advisories/cve-2026-18639/ for the patched release version, which was not independently confirmed in the available data. As an immediate compensating control, operators should configure Velociraptor to validate the email_verified claim from the OIDC token and reject authentication for any session where email_verified is absent or false - this directly closes the impersonation vector. Additionally, review the IdP configuration to restrict self-service email changes, requiring administrator approval or re-verification before an email change takes effect; this reduces the attack surface at the IdP layer independently of the Velociraptor patch. Organizations using IdPs known to omit email_verified (certain self-hosted Keycloak configurations, some legacy OIDC integrations) should audit those IdP settings or migrate to a verified-email-enforcement policy. If immediate patching is not feasible, consider temporarily disabling OIDC login and reverting to an alternative authentication mechanism until the patch is applied, accepting the operational trade-off of reduced SSO integration.
More in Velociraptor
View allPrivilege escalation in Velociraptor's notebook VQL execution path allows analyst-role users to bypass the COLLECT_CLIEN
Directory traversal in Rapid7 Velociraptor servers running on Linux before 0.75.6 lets a rogue enrolled client upload a
Privilege escalation in Rapid7 Velociraptor lets any user permitted to schedule client monitoring artifacts run otherwis
Privilege escalation in Rapid7 Velociraptor allows an authenticated user holding only the 'investigator' role to execute
Privilege escalation to administrator in Rapid7 Velociraptor (all versions before 0.77.2) allows an authenticated low-pr
Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do
Privilege escalation in Velociraptor allows any user with the NOTEBOOK_EDIT permission - typically an analyst-level role
Rapid7 Velociraptor allows users to be created with different privileges on the server. Rated high severity (CVSS 8.8),
Privilege escalation in Rapid7 Velociraptor's multi-tenant org management allows child org administrators to delete any
Remote code execution in Rapid7 Velociraptor server (primarily Linux) allows authenticated clients to write malicious me
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, e
Multi-tenancy authorization bypass in Velociraptor before 0.76.3 allows authenticated GUI users to execute VQL queries a
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.0 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today