Yüksek CVSS 7.3
CVE-2026-18639: CVE-2026-18639: sahtecilikle kimlik doğrulama atlatma
Açıklama (NVD)
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email. This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.
Özet bilgiler
- CVSS v3.1
- 7.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - EPSS
- %0,39 (yüzdelik 33)
- CWE
- CWE-290
- Yama
- Yok / bilinmiyor