A flaw was found in Red Hat Quay's JWT token validation for federated robot accounts and SSO authentication. Three related issues were identified: (1) When no audiences are configured for federated robot authentication (the default), verify_aud is set to False, accepting any validly-signed token from the same IdP regardless of intended audience. (2) The OIDC_ALLOWED_CLIENTS / azp enforcement check in auth/oauth.py short-circuits when the azp claim is absent from the token (None), allowing tokens without an azp claim to bypass client restrictions. (3) Pre-existing federation configurations created before API validation enforcement (or written directly to the database) without a subject field allow tokens without a sub claim to match. These issues could allow an attacker with a validly-signed token from the same identity provider to bypass configured audience, subject, or authorized-client restrictions.