CVE-2026-74240
A flaw was found in Red Hat Quay's JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues related to audience verification and the enforcement of `azp` and `sub` claims were identified. These flaws could allow an attacker with a validly-signed token from the same identity provider to bypass configured security restrictions. This bypass could lead to unauthorized access by circumventing intended audience, subject, or authorized-client limitations.
Attack profile
The conditions required to exploit this vulnerability and its potential impact.
Affected products
Product applicability statements supplied with the NVD record.
Weakness classification
CWE categories help security teams group the underlying software weakness.
Source references
External advisories, patches and technical reports attached to this CVE record.