This vulnerability affects skypilot-org skypilot versions up to 0.12.0 and is due to the use of a weak hash function in the username.encode function of the User ID Handler component (sky/users/server.py). The weakness in the hash algorithm could potentially undermine the security of user identification processes. The attack vector is remote network-based with high complexity and no privileges or user interaction required. Although an exploit is publicly available, the vendor has not released an official fix or mitigation at this time.

The use of a weak hash algorithm may allow attackers to compromise the integrity or uniqueness of user identifiers, potentially leading to security issues related to authentication or user identity management. However, the attack complexity is high and exploitability is difficult, which reduces the immediate risk. No direct impact such as privilege escalation or data disclosure is explicitly described.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been announced by the vendor, users should monitor for updates from skypilot-org. Until a patch is available, consider reviewing the use of the username.encode function and the hash algorithm employed, and apply any recommended best practices from the vendor once published.