CVE-2023-51663
Hail ≤ 0.2.127
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-51663 is a medium-severity Authentication Bypass by Alternate Name (CWE-289) vulnerability in Hail Hail. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 29th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-0289
Vulnerability Data
Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect (OIDC) email addresses from ID tokens to verify the validity of a user's domain, but…
more
because users have the ability to change their email address, they could create accounts and use resources in clusters that they should not have access to. For example, a user could create a Microsoft or Google account and then change their email to `test@example.org`. This account can then be used to create a Hail Batch account in Hail Batch clusters whose organization domain is `example.org`. The attacker is not able to access private data or impersonate another user, but they would have the ability to run jobs if Hail Batch billing projects are enabled and create Azure Tenants if they have Azure Active Directory Administrator access.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 8 hardening rules · 3 OS baselines
V8.3.3V10.3.2V6.4.3
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper identity management reduces alternate-name collisions but does not guarantee canonicalization inside the auth decision.
Strong authentication mechanisms directly prevent name-based bypass when they enforce canonical name checks.
Authorization policy enforcement assumes correct identity; the weakness occurs before policy is applied.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.15 only requires defining and documenting an access control policy plus requirements; it does not itself enforce rules or stop alternate-name authentication bypasses from being exploitable.
A.5.16 manages the lifecycle, uniqueness, and accountability of identities; it has no bearing on a product that authenticates by name but fails to canonicalize or check alternate names for the same resource/actor, so the weakness remains present and exploitable.
Proper management of authentication credentials can include rules against duplicate or alias identities.
A.5.18 governs the provisioning, review, and revocation of already-granted access rights to authenticated identities; it does not address or stop the distinct flaw in which authentication logic accepts an alternate name that bypasses the check.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248538 OL 8 operating systems booted with United Extensible Firmware Interface (UEFI) must have a unique name for the grub superusers account when booting into single-user mode and maintenance. blocks CWE-289
RHEL 7 (1 rule)
- V-244558 Red Hat Enterprise Linux operating systems version 7.2 or newer booted with United Extensible Firmware Interface (UEFI) must have a unique name for the grub superusers account when booting into single-user mode and maintenance. blocks CWE-289