This vulnerability in Red Hat Quay's JWT validation affects federated robot accounts and SSO authentication by failing to properly enforce audience verification and checks on the 'azp' and 'sub' claims. An attacker possessing a validly-signed token from the same identity provider can bypass security restrictions configured to limit access based on these claims. The issue arises from default configurations that do not enforce audience verification and insufficient claim checks in certain scenarios. The vulnerability is rated medium severity with a CVSS 3.1 score of 5.4. Exploitation requires a valid token from the same IdP, which restricts the attack vector. Red Hat's advisory recommends configuring federated robot authentication with specific audiences to enable 'verify_aud' enforcement and updating federation configurations to explicitly enforce 'azp' and 'sub' claims. A service restart may be necessary after applying these configuration changes.

The vulnerability allows an attacker with a valid token from the same identity provider to bypass audience, subject, or authorized-client restrictions, potentially granting unauthorized access to resources or functionality. The impact is limited to confidentiality and integrity with no availability impact. Exploitation requires possession of a valid token, which limits the attack surface. There are no known exploits in the wild at this time.

Red Hat Quay administrators should configure federated robot authentication with specific audiences to enable enforcement of audience verification ('verify_aud'). Additionally, existing federation configurations should be reviewed and updated to explicitly include and enforce the 'azp' and 'sub' claims to prevent bypasses when these claims are missing. After applying these configuration changes, affected Quay services may require a restart. Since this is a cloud service, Red Hat manages remediation for the hosted service; administrators should follow the vendor advisory for detailed configuration steps and updates.