CVE-2026-18639 Velociraptor OIDC Authenticator susceptible to email spoofing
Attackers can impersonate users and take over accounts by spoofing email claims in OIDC authentication if the IdP does not verify emails.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-18639?
CVE-2026-18639 is a high-severity authentication bypass vulnerability in Rapid7 Velociraptor, published on 11 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email.
This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.
Weakness: CWE-290
Which versions are affected by CVE-2026-18639?
How do I fix CVE-2026-18639?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-18639 being exploited?
There is no known exploitation of CVE-2026-18639 in the wild and no public exploit code.
Sources
Also known as GHSA-7v2v-mhwj-r9rw.