https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 07:07:43 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-18639 <p>When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the &#34;email_verified&#34; claim and do not actually verify the email.</p> <p>This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.</p> <p>When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the &#34;email_verified&#34; claim and do not actually verify the email.</p> <p>This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-18639 https://vulnerability.circl.lu/vuln/ghsa-7v2v-mhwj-r9rw <p>When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the &#34;email_verified&#34; claim and do not actually verify the email.</p> <p>This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.</p> <p>When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the &#34;email_verified&#34; claim and do not actually verify the email.</p> <p>This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.</p> https://vulnerability.circl.lu/vuln/ghsa-7v2v-mhwj-r9rw https://vulnerability.circl.lu/vuln/opensuse-su-2026:12070-1 <p>velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media</p> <p>velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media</p> https://vulnerability.circl.lu/vuln/opensuse-su-2026:12070-1