The vulnerability resides in the username.encode function within the User ID Handler of Skypilot. It utilizes a weak hashing algorithm as described by CWE‑327 and CWE‑328, allowing an attacker to potentially reconstruct or guess user credentials. The description indicates the flaw can be exploited remotely, though the attack carries high complexity and is considered difficult. Nonetheless, the exploit is publicly available, raising the risk of unauthorized authentication or credential theft.

All installations of skypilot-org Skypilot up to version 0.12.0 are affected. No specific upgrades are listed, but any deployment using these versions must be reviewed for remediation.

The CVSS score of 6.3 denotes medium severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Despite the lack of a statistical exploit probability, the described remote nature and publicly available exploit suggest a non‑negligible threat. Attackers would need to contend with the high complexity and difficulty noted by the vendor, yet the existence of a public exploit lowers the overall barrier for potential use.