The vulnerability resides within the jwcrypto library, which handles JOSE standards. A coding error causes the library to fail to correctly identify the key ID (kid) when verifying a General JSON Serialization JWS that uses a collection of keys. As a result, any key from the set that successfully verifies the signature is accepted, regardless of its intended association with a specific tenant or user. This flaw can be exploited to circumvent authorization checks in applications that rely on the kid for tenant or user identification, effectively granting unauthorized access or privilege escalation.

Affected products include Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux releases 7, 8, 9, and 10, Red Hat OpenShift AI (RHOAI), and Red Hat OpenStack Platform 16.2. Version information for the vulnerable release is not explicitly provided in the advisory; clients should verify whether their current deployment incorporates the susceptible jwcrypto library and assess exposure accordingly.

The CVSS score is 5.9, indicating moderate severity, and the EPSS score is not available while the vulnerability is not listed in CISA KEV. The likely attack vector is the ability to supply a forged JWS signed with any key from a trusted key set, suggesting that remote or local attackers may exploit the flaw if the offending library processes user-supplied tokens. Because the flaw leads to bypassing key‑based authorization, the impact can be substantial in high‑privilege contexts, warranting timely remediation.