This advisory concerns Red Hat Quay 3.10.20 and multiple associated CVEs, notably CVE-2026-28498, which involves a critical vulnerability in the Authlib library. Authlib's OIDC ID Token validation fails open when unsupported cryptographic algorithms are used, allowing forged tokens to be accepted as valid. This flaw enables remote attackers to bypass authentication mechanisms, impacting confidentiality and integrity of affected systems. The vulnerability requires no authentication or user interaction to exploit. Red Hat Quay products using Authlib for OIDC validation are affected. The advisory references seven CVEs in total and classifies the severity as high. The fix for Authlib is available in version 1.6.9, but the Red Hat advisory for Quay 3.10.20 does not explicitly confirm patch availability for all vulnerabilities. The advisory recommends applying the update after ensuring all previous errata are applied.

The main impact is a high-severity authentication bypass vulnerability that compromises confidentiality and integrity by allowing attackers to present forged OIDC ID Tokens as valid. This can grant unauthorized access to systems relying on Authlib for OIDC authentication. The vulnerability requires no privileges or user interaction to exploit. Other CVEs included in the advisory may have additional impacts, but details are not provided. No known exploits in the wild have been reported at this time.

Red Hat has released Quay 3.10.20 which includes bug fixes addressing these vulnerabilities. Users should apply this update after confirming that all previously released errata relevant to their system have been applied. The advisory does not explicitly confirm patch availability for all CVEs, so users should monitor Red Hat's official advisories and apply updates promptly. For the Authlib vulnerability (CVE-2026-28498), upgrading to Authlib version 1.6.9 or later mitigates the issue. No additional mitigations or workarounds are specified by Red Hat.