Authentication Bypass

hail is is vulnerable to Authentication Bypass. The vulnerability is due to improper validation while handling OpenID Connect (OIDC) email addresses. This lack of verification of the user’s email domain allows an attacker to manipulate their email address to match an organization’s domain with organization level permissions, allowing the attacker gain unauthorized access to some resources in Hail Batch clusters, such as the ability to run hail jobs.