Security Flaw in Red Hat Quay's JWT Validation for Federated Accounts
CVE-2026-74240
5.4MEDIUM
What is CVE-2026-74240?
A vulnerability has been identified in Red Hat Quay's implementation of JSON Web Token (JWT) validation, particularly affecting federated robot accounts and single sign-on (SSO) mechanisms. The flaw arises from insufficient audience verification and lax enforcement of 'azp' and 'sub' claims, permitting an attacker to exploit validly-signed tokens from the same identity provider. Consequently, this could enable an unauthorized user to bypass critical security restrictions, leading to potential unauthorized access and manipulation of system resources.
References
CVSS V3.1
Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank meifukun (https://github.com/meifukun) for reporting this issue.