What is CVE-2026-18639?

CVE-2026-18639 is a high-severity vulnerability in Rapid7 Velociraptor, classified under Authentication Bypass by Spoofing. CVSS score: 7.3/10. Published 2026-08-11.

How severe is CVE-2026-18639?

High severity. CVSS v3 base score is 7.3 out of 10.

Vulnerability in Rapid7 Velociraptor

CVE-2026-18639

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and…

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N.

Affected products

Rapid7 Velociraptor — versions 0

Weakness classification (CWE)

CWE-290 — Authentication Bypass by Spoofing

References

cve@rapid7.com

Frequently asked questions

What is CVE-2026-18639?: CVE-2026-18639 is a high-severity vulnerability in Rapid7 Velociraptor, classified under Authentication Bypass by Spoofing. CVSS score: 7.3/10. Published 2026-08-11.
How severe is CVE-2026-18639?: High severity. CVSS v3 base score is 7.3 out of 10.