CVE-2026-18639

Velociraptor's OIDC authentication treats the email claim as an immutable identity anchor when RFC 7519 explicitly designates the 'sub' claim as the stable OIDC identifier. This is not a code bug—it is a design flaw where the application conflated user-reachable state (email) with authoritative identity (subject). An attacker who gains control of a user's email address at the Identity Provider can hijack that user's Velociraptor account, even without compromising the IdP itself. The email claim is mutable by the user; the 'sub' claim is not. The CVSS 7.3 rating warrants skepticism in this context. Velociraptor operates at the apex of enterprise security infrastructure—it manages hunts, collects endpoint artifacts, and preserves evidence chains. A compromised admin account here is not a generic web app takeover. An attacker could exfiltrate investigative data, tamper with evidence integrity, or deploy collection artifacts across the monitored environment. The CVSS scoring treats this as a moderate account takeover in isolation from its operational blast radius, which understates the real risk to organizations relying on Velociraptor for incident response. The remediation architecture will expose whether Velociraptor's team understood the root cause or merely patched the symptom. Two paths exist: enforce email_verified=True as a binding requirement (rejecting IdP assertions that don't meet it), or migrate identity to the 'sub' claim entirely, treating email as a display attribute only. The first approach binds Velociraptor's security to IdP verification policies—a layer of state outside Velociraptor's control that can change. The second approach excises the vulnerable assumption from the codebase entirely. If the fix only adds email_verified checks without migrating to 'sub', this was treated as a bug report rather than a design error—and the same trap remains available in every future OIDC integration. This vulnerability class has a documented history: the same mistake replayed across OAuth implementations in 2012-2015, was locally fixed and globally lost, then reappeared in OIDC integrations. The lesson was never codified into durable design principles—it lived in institutional knowledge that evaporated across personnel transitions. The fix Velociraptor ships will reveal whether they broke that lineage or just patched one instance of it.

Reviewed through automated stages and approved by a human before publication.