Rapid7 Velociraptor versions prior to 0.77.2, when configured to use an OIDC IdP for authentication, rely on the email claim as the username. Certain IdPs permit users to modify the email claim without verification or omit the "email_verified" claim, resulting in unverified email addresses being accepted. This allows an attacker to spoof the email claim and impersonate other users, effectively bypassing authentication controls and taking over accounts.

Successful exploitation allows an attacker with some level of access (low privilege user) to impersonate any other user by spoofing the email claim in the IdP. This leads to a complete compromise of the victim's account, including confidentiality and integrity of that user's data and actions within Velociraptor. Availability is not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should carefully evaluate the trustworthiness of their OIDC IdP's email verification process and consider additional verification mechanisms or restrict authentication to IdPs that enforce verified email claims.