Unauthorized access via incomplete JWT claim validation

Improper authentication in Red Hat Quay and OpenShift Update Service allows remote authenticated users to bypass access restrictions. Federated robot and SSO JWT validation skips audience verification by default and insufficiently enforces the azp and sub claims, accepting tokens outside configured client or subject limits. Exploitation requires a validly signed token from the same identity provider and exposes resources permitted by the bypassed claim restrictions.