Velociraptor uses the email claim from an OIDC Identity Provider as the username. Some IdPs allow users to change the email claim without verification, and many do not set or check the "email_verified" claim. This permits an attacker to falsify the email address and impersonate another user, leading to account takeover. The weakness is identified as CWE‑290, an authentication bypass flaw.

Rapid7 Velociraptor, all deployments that have enabled the OIDC authenticator. No specific version is listed, so the issue potentially affects every release that relies on the default email claim for authentication.

The CVSS v3 score of 7.3 indicates a high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting no known public exploitation yet. The likely attack vector requires access to an OIDC IdP that allows unconstrained modification of the email claim. If the IdP enforces email verification, the exploitability is significantly reduced, though the underlying logic still permits spoofing when the IdP’s validation is weak.