CVE-2026-18639: Velociraptor Auth Bypass Vulnerability

CVE-2026-18639 Overview

CVE-2026-18639 is an authentication bypass vulnerability in Velociraptor when configured to use an OpenID Connect (OIDC) Identity Provider (IdP) for authentication. Velociraptor treats the email claim returned by the IdP as the username. Because some IdPs allow users to modify their email claim without verification, and others omit the email_verified claim entirely, an attacker can impersonate another Velociraptor user by setting the target user's email address in the IdP. Successful exploitation results in account takeover of the impersonated Velociraptor account, including any privileges assigned to it. The issue is classified under CWE-290: Authentication Bypass by Spoofing.

Critical Impact
An attacker with the ability to change their email in a permissive OIDC IdP can impersonate any Velociraptor user, including administrators, leading to full account takeover of the digital forensics and incident response platform.

Affected Products

Velociraptor digital forensics and incident response (DFIR) platform
Velociraptor deployments configured with an OIDC IdP for authentication
Deployments using IdPs that do not verify or enforce the email_verified claim

Discovery Timeline

2026-08-11 - CVE-2026-18639 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-18639

Vulnerability Analysis

Velociraptor supports OIDC as an authentication method, delegating user identity verification to an external IdP. When a user authenticates, Velociraptor reads the email claim from the OIDC ID token and uses it as the internal username to map the session to a Velociraptor account and its assigned roles. This mapping is the sole basis for authorization decisions on the server.

The design assumes the email claim is a trusted, verified identifier of the user. That assumption does not hold across all IdPs. Some providers let end users modify their email address in the user profile without out-of-band verification. Others issue tokens that omit the email_verified claim, meaning the IdP never confirmed control of the mailbox. Velociraptor did not enforce that email_verified be present and true before trusting the claim.

The result is a spoofable identifier being used as a security-relevant primary key, matching the CWE-290 pattern.

Root Cause

The root cause is trust in an unverified assertion from a third party. Velociraptor equates the email claim with a Velociraptor identity, but does not require cryptographic or procedural proof that the authenticating principal actually owns that email address. When paired with an IdP that does not verify email ownership, the identity mapping collapses.

Attack Vector

The attack requires network access to the Velociraptor OIDC login flow and a user account in a permissive IdP that is federated with the target Velociraptor instance. The attacker updates the email attribute on the attacker-controlled IdP account to match a target Velociraptor user's email, for example an administrator. The attacker then authenticates to Velociraptor through the OIDC flow. Velociraptor receives an ID token containing the spoofed email, maps the session to the victim's Velociraptor account, and grants the attacker the victim's roles and permissions. See the Velociraptor Security Advisory CVE-2026-18639 for vendor details.

Detection Methods for CVE-2026-18639

Indicators of Compromise

OIDC authentication events in Velociraptor logs where the same email address is used from unexpected source IPs, user agents, or geolocations within a short time window.
IdP audit logs showing recent modifications to a user's email attribute followed by a login to Velociraptor.
Velociraptor sessions performing high-privilege actions such as new artifact collections, offline collectors, or user administration shortly after an OIDC login from a previously unseen client fingerprint.

Detection Strategies

Correlate IdP email-change events with subsequent Velociraptor authentication events by email address and time proximity.
Alert on OIDC tokens presented to Velociraptor that are missing the email_verified claim or where email_verified is false.
Baseline each Velociraptor user's typical login source and flag deviations for OIDC-authenticated sessions.

Monitoring Recommendations

Forward Velociraptor GUI authentication and audit logs to a central SIEM or data lake for correlation with IdP logs.
Monitor privileged Velociraptor actions such as server.Utils.CreateCollector, artifact modifications, and user role changes, tying each action back to the authenticated OIDC principal.
Track IdP administrative events for changes to email attributes, especially on accounts that can authenticate to security tooling.

How to Mitigate CVE-2026-18639

Immediate Actions Required

Review the Velociraptor Security Advisory CVE-2026-18639 and upgrade Velociraptor to the fixed version identified by the vendor.
Audit the IdP used with Velociraptor to determine whether users can change their email address without verification, and whether the IdP emits email_verified.
Review recent Velociraptor OIDC logins and IdP email-change history for signs of impersonation of privileged users.

Patch Information

Refer to the Velociraptor Security Advisory CVE-2026-18639 for the fixed release. The vendor guidance is to upgrade to a version that requires the email_verified claim and to use stable identifiers, such as the OIDC sub claim, rather than mutable email addresses for user mapping.

Workarounds

Restrict Velociraptor OIDC authentication to an IdP that verifies email ownership and always issues email_verified: true.
Disable end-user modification of the email attribute in the IdP, or require administrator approval and re-verification for any change.
Restrict the OIDC application in the IdP to a specific group of trusted users, reducing the population that can attempt impersonation.
Where possible, front the Velociraptor GUI with network-level controls such as VPN or IP allow-listing to limit exposure of the OIDC login endpoint.