https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 15:25:06 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-356657 EUVD-2026-356657 https://cve.radiocsirt.org/vuln/euvd-2026-356657 https://cve.radiocsirt.org/vuln/fkie_cve-2026-74240 <p>A flaw was found in Red Hat Quay&#39;s JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues related to audience verification and the enforcement of `azp` and `sub` claims were identified. These flaws could allow an attacker with a validly-signed token from the same identity provider to bypass configured security restrictions. This bypass could lead to unauthorized access by circumventing intended audience, subject, or authorized-client limitations.</p> <p>A flaw was found in Red Hat Quay&#39;s JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues related to audience verification and the enforcement of `azp` and `sub` claims were identified. These flaws could allow an attacker with a validly-signed token from the same identity provider to bypass configured security restrictions. This bypass could lead to unauthorized access by circumventing intended audience, subject, or authorized-client limitations.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-74240 https://cve.radiocsirt.org/vuln/ghsa-3vf7-35c7-wgcv <p>A flaw was found in Red Hat Quay&#39;s JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues related to audience verification and the enforcement of `azp` and `sub` claims were identified. These flaws could allow an attacker with a validly-signed token from the same identity provider to bypass configured security restrictions. This bypass could lead to unauthorized access by circumventing intended audience, subject, or authorized-client limitations.</p> <p>A flaw was found in Red Hat Quay&#39;s JWT (JSON Web Token) validation for federated robot accounts and single sign-on (SSO) authentication. Multiple issues related to audience verification and the enforcement of `azp` and `sub` claims were identified. These flaws could allow an attacker with a validly-signed token from the same identity provider to bypass configured security restrictions. This bypass could lead to unauthorized access by circumventing intended audience, subject, or authorized-client limitations.</p> https://cve.radiocsirt.org/vuln/ghsa-3vf7-35c7-wgcv