CVE-2026-18639: 
Velociraptor vulnerability analysis and mitigation

CVE-2026-18639 is an authentication bypass vulnerability in Rapid7 Velociraptor affecting all versions prior to 0.77.2. When Velociraptor is configured to use an OpenID Connect (OIDC) Identity Provider (IdP) for authentication, it trusts the email claim as the username without verifying whether the IdP has validated that email address. This allows an attacker with a low-privileged account on a permissive IdP to change their email to match a victim's, enabling account takeover. It carries a CVSS v3.1 base score of 7.3 (High) and is classified under CWE-290 (Authentication Bypass by Spoofing) (Velociraptor Advisory, ENISA EUVD).

The root cause is Velociraptor's unconditional trust in the email claim returned by an OIDC IdP, without checking the email_verified claim or enforcing that the IdP has actually verified the address (CWE-290: Authentication Bypass by Spoofing). Some IdPs permit users to freely change their email address without re-verification, and others omit the email_verified field entirely. An attacker who controls a valid account on such an IdP can set their email to match a target user's address, causing Velociraptor to authenticate them as that user upon next login. No memory corruption or code injection is involved; the flaw is purely a logic/trust issue in the authentication flow (Velociraptor Advisory, ENISA EUVD).

Successful exploitation results in full account takeover of any Velociraptor user whose email can be impersonated through the IdP, with high confidentiality and integrity impact (availability is unaffected). Because Velociraptor is a digital forensics and incident response (DFIR) platform with broad endpoint visibility, a compromised administrator account could expose sensitive forensic data, endpoint telemetry, and investigation artifacts across all monitored systems. An attacker gaining access to a privileged Velociraptor account could also deploy malicious VQL artifacts to endpoints, enabling lateral movement or persistent access across the managed fleet (Velociraptor Advisory, ENISA EUVD).

As of the time of publication, no public proof-of-concept exploit code or in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The NVD SSVC assessment confirms exploitation status as "none" and notes the attack is not automatable, as it requires user interaction (the victim must log in after the attacker has changed their IdP email). The EPSS score is approximately 0.0026 (0.26%), indicating a low near-term exploitation probability (Velociraptor Advisory, ENISA EUVD).

1. Identify target: Determine that the Velociraptor deployment uses OIDC authentication and identify the IdP in use (e.g., Google, Okta, a self-hosted IdP).
2. Assess IdP permissiveness: Confirm that the IdP either does not enforce email_verified or allows users to change their email address without re-verification.
3. Register/control an account: Obtain a legitimate low-privileged account on the same IdP used by the target Velociraptor instance.
4. Change email to victim's address: Within the IdP's account settings, update the attacker's email address to match the email address of the target Velociraptor user (e.g., an administrator).
5. Authenticate to Velociraptor: Log in to the Velociraptor web interface using OIDC. Velociraptor reads the email claim from the IdP token and maps it directly to the victim's account without verifying email_verified.
6. Achieve account takeover: The attacker is now authenticated as the victim user, gaining access to all data, investigations, and capabilities associated with that account (Velociraptor Advisory).

• Logs: Velociraptor authentication logs showing a successful login for a user account from an unexpected IP address or geographic location; OIDC token logs at the IdP showing an email address change followed shortly by a Velociraptor login event.
• IdP Audit Logs: Records of email address modifications for accounts that do not correspond to expected user activity, particularly changes to email addresses matching known Velociraptor administrators.
• Velociraptor Activity: Unexpected VQL queries, new artifact collections, or configuration changes initiated under a legitimate user's account, especially outside normal working hours or from unfamiliar client IPs.
• Network: Login sessions originating from IP addresses not previously associated with the impersonated user account.

Rapid7 has released Velociraptor version 0.77.2, which addresses this vulnerability by enforcing validation of the email_verified claim from the OIDC IdP before accepting the email as a trusted username. Organizations should upgrade to version 0.77.2 or later immediately. As a workaround prior to patching, administrators should configure their OIDC IdP to enforce email verification and restrict users from changing their email addresses without re-verification, or switch to an IdP that always sets and enforces the email_verified claim. Additionally, restricting Velociraptor access to known, trusted IdP accounts and monitoring IdP audit logs for unexpected email changes can reduce risk (Velociraptor Advisory, Velociraptor v0.77.2 Release).