A flaw in Red Hat Quay allows a user with a timed‑out or idle authenticated session to bypass the re‑authentication prompt required for sensitive operations such as token generation or robot account creation. The vulnerability enables the execution of privileged actions without supplying a valid password, even though the user interface displays an error for invalid credentials. This represents an authentication bypass weakness (CWE‑613) that can grant unauthorized access to critical administrative functions.

Red Hat Quay (version 3). No specific sub‑versions are listed, so all installations of Quay 3 are considered potentially affected.

The CVSS score of 5.4 indicates a medium severity vulnerability, and the EPSS score is not available. It is not listed in the CISA KEV catalog. The likely attack vector involves an idle authenticated browser session or a session that has timed out. An attacker exploiting this flaw can perform privileged operations without presenting valid credentials, potentially allowing unauthorized creation of tokens or robot accounts, thereby escalating privileges or compromising downstream services.