Description

A flaw was found in Quay. A cross-site scripting (XSS) vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper input sanitization to run client-side scripts in the application context. Successful exploitation could allow the attacker to compromise the user's session, access sensitive registry information, or perform unauthorized actions on their behalf.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-10-05T18:17:31.057Z",
  "pubdate": "2026-10-05T18:17:31.057Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the OAuth callback handler of the Quay container registry platform.\nThe flaw stems from insufficient input sanitization during the OAuth handshake process, which enables a remote, unauthenticated attacker to inject and execute arbitrary JavaScript within the context of an authenticated user's session.\nThis vulnerability poses a significant security risk, as successful exploitation allows for the compromise of user sessions, potential unauthorized access to sensitive container registry metadata, and the execution of arbitrary actions on behalf of the victim.\nExploitation requires the attacker to successfully social-engineer a logged-in user into navigating to a maliciously crafted URL.\nWhile the attacker does not require direct access to the Quay backend, the successful execution of malicious scripts within the browser allows for session hijacking or data exfiltration, effectively bypassing the same-origin policy protections intended for the application.",
  "technicalDetails": "The vulnerability is classified as a Reflected Cross-Site Scripting (XSS) flaw located within the OAuth callback mechanism of the Quay application.\nThe root cause of this vulnerability is the failure of the OAuth callback handler to perform adequate input validation and contextual encoding on parameters processed during the OAuth authorization flow.\nWhen a user is redirected back to the Quay registry from an OAuth provider, the application parses incoming URL parameters. Due to improper sanitization, these parameters are reflected back into the HTTP response body without sufficient escaping.\nThe attack flow begins when an attacker constructs a malicious URL containing a payload designed to break out of the intended HTML context. This URL typically includes an obfuscated JavaScript snippet injected into one of the OAuth callback parameters.\nThe attacker then tricks an authenticated Quay user into clicking the crafted link. Upon clicking, the user's browser sends the request to the Quay callback endpoint. The server processes the request and reflects the malicious script back to the user's browser.\nBecause the script is returned as part of the application's legitimate response, the browser executes the payload within the security context of the Quay domain.\nThe payload operates with the privileges of the victim, allowing it to access document cookies—unless protected by the HttpOnly flag—local storage, and session tokens. Furthermore, the script can issue unauthorized XHR or Fetch requests to the Quay API, enabling the attacker to modify registry configurations, view private repository content, or interact with sensitive user data.\nThe impact is significant as it facilitates complete session hijacking and potential account takeover. The vulnerability demonstrates a failure in the input validation layer during the authentication callback lifecycle. Given the nature of the OAuth flow, this vulnerability highlights the necessity for strict adherence to Content Security Policy (CSP) headers and robust output encoding libraries to neutralize injected script execution before the browser renders the callback response."
}