CVE-2026-102295: Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter
A DOM-based cross-site scripting (XSS) flaw was found in Project Quay's OAuth local callback handler (OAuthLocalHandler.tsx). When the format=json query parameter is supplied, the component reads the accesstoken from the URL fragment and assigns it to document.body.innerHTML via JSON.stringify, which does not HTML-encode angle brackets. An attacker can craft a URL containing a malicious accesstoken in the fragment that, when clicked by a Quay user, executes arbitrary JavaScript in the Quay registry origin. The format=json code path bypasses OAuth state validation and requires no authentication.
Other sources
A flaw was found in Quay. A cross-site scripting (XSS) vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper input sanitization to run client-side scripts in the application context. Successful exploitation could allow the attacker to compromise the user's session, access sensitive registry information, or perform unauthorized actions on their behalf.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Any Quay user who visits an attacker-crafted OAuth local callback URL may be exposed. The impact is greatest for users with an active Quay session, because script execution occurs in the Quay registry origin and may allow actions in that user's context.
What does an attacker need to exploit it?
The attacker needs to convince a user to click or otherwise open a crafted URL containing a malicious access_token value in the URL fragment and the format=json query parameter. No authentication is required for the vulnerable code path, and the OAuth state validation is bypassed.
Is normal OAuth state validation a protection against this attack?
No. Supplying format=json reaches a code path that bypasses OAuth state validation.
How can I identify potentially vulnerable requests or exploit attempts?
Look for requests to the OAuth local callback handler with format=json in the query string. Exploit URLs also place the access_token payload in the URL fragment, although fragments are processed by the browser and are not normally sent to the server.