CVE-2023-51663 json
Hail authentication can be bypassed by changing email address
published 2023-12-29 2 y ago modified 2026-09-10 1 mo ago also GHSA-487p-qx68-5vjw , PYSEC-2023-271 , EUVD-2023-0289
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 30%
- public exploits
- 0
- none known
Summary
Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect (OIDC) email addresses from ID tokens to verify the validity of a user's domain, but because users have the ability to change their email address, they could create accounts and use resources in clusters that they should not have access to. For example, a user could create a Microsoft or Google account and then change their email to `test@example.org`. This account can then be used to create a Hail Batch account in Hail Batch clusters whose organization domain is `example.org`. The attacker is not able to access private data or impersonate another user, but they would have the ability to run jobs if Hail Batch billing projects are enabled and create Azure Tenants if they have Azure Active Directory Administrator access.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.37% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | hail | <0.2.127 |
0.2.127 |
Affected products
- hail-is hail
Classification
- Weakness
-
- CWE-289 Authentication Bypass by Alternate Name
References
-
github.com
/hail-is/hail/commit/0dcc17ff24564b6f5592261d7975e8afd0f95de7
web
-
github.com
/hail-is/hail/security/advisories/GHSA-487p-qx68-5vjw
web, mitigation, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-51663
advisory
-
github.com
/hail-is/hail
package
-
github.com
/pypa/advisory-database/tree/main/vulns/hail/PYSEC-2023-271.yaml
web
Sources
- CVE List CVE-2023-51663
- GitHub Advisory GHSA-487p-qx68-5vjw
- NVD CVE-2023-51663
- OSV PYSEC-2023-271
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.