CVE-2023-51663

    Dashboard / Vulnerabilities / CVE-2023-51663

    CVE-2023-51663

    Published: 29 Dec 2023Last Modified: 12 Aug 2026

    Summary: Hail authentication can be bypassed by changing email address

    Details: Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect (OIDC) email addresses from ID tokens to verify the validity of a user's domain, but because users have the ability to change their email address, they could create accounts and use resources in clusters that they should not have access to. For example, a user could create a Microsoft or Google account and then change their email to `[email protected]`. This account can then be used to create a Hail Batch account in Hail Batch clusters whose organization domain is `example.org`. The attacker is not able to access private data or impersonate another user, but they would have the ability to run jobs if Hail Batch billing projects are enabled and create Azure Tenants if they have Azure Active Directory Administrator access.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51663.json, https://github.com/hail-is/hail/security/advisories/GHSA-487p-qx68-5vjw, https://nvd.nist.gov/vuln/detail/CVE-2023-51663

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -bb535cd096c5e10725aaf6c425350366cedfcace

    Affected versions

    0.2.126
    0.2.125
    0.2.124
    0.2.123
    0.2.122
    0.2.121
    0.2.120
    0.2.119
    0.2.118
    0.2.117
    0.2.116
    0.2.115
    0.2.114
    0.2.113
    0.2.112
    0.2.111
    0.2.110
    0.2.109
    0.2.108
    0.2.107
    0.2.106
    0.2.105
    0.2.104
    0.2.103
    0.2.102
    0.2.101
    0.2.100
    0.2.99
    0.2.98
    0.2.97
    0.2.96
    0.2.95
    0.2.94
    0.2.93
    0.2.92
    0.2.91
    0.2.90
    0.2.89
    0.2.88
    0.2.87
    0.2.86
    0.2.85
    0.2.84
    0.2.83
    0.2.82
    0.2.81
    0.2.80
    0.2.79
    0.2.78
    0.2.77
    0.2.76
    0.2.75
    0.2.74
    0.2.73
    0.2.72
    0.2.71
    0.2.70
    0.2.69
    0.2.68
    0.2.67
    0.2.66
    0.2.65
    0.2.64
    0.2.63
    0.2.62
    0.2.61
    0.2.60
    0.2.59
    0.2.58
    0.2.57
    0.2.56
    0.2.55
    0.2.54
    0.2.53
    0.2.52
    0.2.51
    0.2.50
    0.2.49
    0.2.48
    0.2.47
    0.2.46
    0.2.45
    0.2.44
    0.2.43
    0.2.42
    0.2.41
    0.2.40
    0.2.39
    0.2.38
    0.2.37
    0.2.36
    0.2.35
    0.2.34
    0.2.33
    0.2.32
    0.2.31
    0.2.30
    0.2.29
    0.2.28
    0.2.27
    0.2.26
    0.2.25
    0.2.24
    0.2.23
    0.2.22
    0.2.21
    0.2.20
    0.2.19
    0.2.18
    0.2.17
    0.2.16
    0.2.15
    0.2.14
    0.2.13
    0.2.12
    0.2.11
    0.2.10
    0.2.9
    0.2.8
    0.2.7
    0.2.6
    0.2.5
    0.2.4

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-51663 | CVE-DB