PatchTheCVECVE-2026-18639: When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username
CVE-2026-18639 is a high-severity flaw (CVSS 7.3) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email. This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.3 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 0.4% (top 68%) |
| CISA exploited list | No |
| Weakness | CWE-290 |
| Published | 2026-08-11 |
| Last modified | 2026-10-23 |
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-18639?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-18639 being exploited?
CVE-2026-18639 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-18639 affect?
CVE-2026-18639 affects affected software. Severity is high (CVSS 7.3). When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and
How urgent is CVE-2026-18639?
Priority 33/100. High severity