CVE-2026-74240

Name of the Vulnerable Software and Affected Versions Red Hat Quay (affected versions not specified)

Description Red Hat Quay contains flaws in the validation of JSON Web Tokens (JWT) used for single sign-on (SSO) authentication and federated robot accounts. The issues involve improper audience verification and failure to correctly enforce the azp (authorized party) and sub (subject) claims. An attacker possessing a validly-signed token from the same identity provider could exploit these flaws to bypass security restrictions, potentially gaining unauthorized access by circumventing limitations placed on the subject, audience, or authorized client.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.