REDHAT-BUG-2543208: Medium severity Project Quay Quay vulnerability

Published Sep 29, 2026

Updated

A DOM-based cross-site scripting flaw was found in Project Quay's signin page (Signin.tsx). After a user completes a successful direct database login, the component reads the redirecturl query parameter and assigns it to window.location.href without validating the URL scheme or origin. An attacker can set redirecturl to a javascript: URI, causing arbitrary JavaScript execution in the authenticated Quay session after login. Exploitation requires the target deployment to use database authentication and the user to successfully authenticate through the crafted URL.

Affected Software

1 affected component

Project Quay Quay

Event History

Sep 29, 2026

Data Sourced

via Red Hat·01:58 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments and users are exposed?

Deployments using database authentication are affected. Exploitation requires a user to successfully complete a direct database login after opening an attacker-crafted URL.

What does an attacker need to do to exploit this issue?

The attacker needs to provide a crafted signin URL whose redirect_url parameter uses a javascript: URI. The payload executes only after the target user authenticates successfully in the affected Quay session.