Medium severity · published Jun 12, 2024
CVE-2024-5891
Quay: unauthorized user may authenticate via oauth application token
4.2
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was found in Quay. If an attacker can obtain the client ID for an application, they can use an OAuth token to authenticate despite not having access to the organization from which the application was created. This issue is limited to authentication and not authorization. However, in configurations where endpoints rely only on authentication, a user may authenticate to applications they otherwise have no access to.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Quay 3 · Red Hat
All versions, or not specified · source: vendor
QU
Quay · Redhat
3.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-5891
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-5891
Broken Link
https://access.redhat.com/security/cve/CVE-2024-5891
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2283879
More from Red Hat Quay 3
10.0
CVE-2026-46595
Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
9.9
CVE-2025-62718
Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF
9.8
CVE-2026-39892
cryptography has a buffer overflow if non-contiguous buffers were passed to APIs
9.8
CVE-2025-56005
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function
9.1
CVE-2026-42508
Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts