A flaw in the JWT validation logic in Red Hat Quay enables an attacker with a validly signed token from an identity provider to bypass security checks applied to federated robot accounts and single‑sign‑on authentication. The problem stems from incomplete audience verification and a failure to enforce the azp and sub claims, which normally restrict access to a specific client or subject. A successful bypass would allow the attacker to access resources that normally require the correct token claims, effectively compromising authentication controls.

Products affected are Red Hat Quay 3 running on the Red Hat OpenShift Update Service. All current releases of Quay 3 could be impacted, as no version ranges were specified. Any deployment of Quay 3 with federated robot or SSO authentication enabled should verify whether the configuration includes proper audience, azp, and sub claim enforcement.

The CVSS score of 5.4 categorizes the vulnerability as moderate. EPSS is not available, so the likelihood of exploitation remains uncertain; no known exploits have been reported and the issue is not listed in CISA KEV. The primary attack vector is inferred to be possession of a validly signed token issued by the same identity provider; once such a token is obtained, the bypass can be performed with no additional privileges, granting unauthorized access.