CVE-2026-74240 describes a vulnerability in Red Hat Quay's JWT validation mechanism used for federated robot accounts and single sign-on authentication. The flaw arises from default configurations that do not enforce audience verification and insufficient validation of 'azp' (authorized party) and 'sub' (subject) claims in certain scenarios. An attacker with a validly-signed token from the same identity provider can exploit these weaknesses to bypass security restrictions intended to limit access based on audience, subject, or authorized client. The vulnerability is classified under CWE-287 (Improper Authentication) and has a CVSS v3.1 score of 5.4 (medium severity). Exploitation requires possession of a valid token from the same IdP, which restricts the scope of attack. Red Hat has not released a patch but recommends configuration changes to enforce claim verification and audience checks to mitigate the issue.

The vulnerability allows unauthorized access by bypassing configured security restrictions related to JWT audience, subject, and authorized-client claims. This could lead to exposure of resources or functionality to unintended actors. The impact is limited by the requirement that the attacker must have a valid token from the same identity provider. Confidentiality and integrity impacts are rated low, with no availability impact.

Red Hat Quay administrators should configure federated robot authentication with specific audiences to enable enforcement of 'verify_aud'. They must review and update federation configurations to explicitly include and enforce 'azp' and 'sub' claims to prevent bypasses when these claims are missing. A restart of affected Quay services may be necessary after applying configuration changes. No official patch is currently available; patch status is not yet confirmed — check the Red Hat advisory for updates. Follow the detailed configuration guidance in Red Hat Quay documentation.