CVE-2026-102295: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Red Hat Red Hat Quay 3

CVE-2026-102295 describes a cross-site scripting (XSS) vulnerability in Quay's OAuth callback handler. The vulnerability arises from improper input sanitization, enabling a remote attacker to inject and execute arbitrary JavaScript code in the context of a user's session. This occurs when a logged-in user is tricked into clicking a specially crafted link. The flaw could allow attackers to compromise user sessions, access sensitive data, or perform unauthorized actions within the application. The CVSS 3.1 base score is 5.4, indicating medium severity. There is no information about affected versions or available patches.

Successful exploitation allows remote attackers to execute arbitrary JavaScript in the context of a logged-in user's browser session. This can lead to session hijacking, unauthorized actions performed on behalf of the user, and potential exposure of sensitive registry information. The impact is limited to confidentiality and integrity, with no direct availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when clicking on OAuth callback links and consider additional protective measures such as web application firewalls or input validation enhancements if possible.