CVE-2026-102295: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Red Hat Red Hat Quay 3

This vulnerability in Red Hat Quay 3 involves improper neutralization of input during web page generation in the OAuth callback handler, enabling a cross-site scripting (XSS) attack. An attacker can craft a malicious link that, when visited by an authenticated user, executes arbitrary JavaScript code in the user's browser session. This can result in the attacker gaining access to sensitive registry information or performing unauthorized actions on behalf of the user. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and limited confidentiality and integrity impact.

Successful exploitation allows execution of arbitrary JavaScript in the context of the victim's browser session, potentially leading to session compromise, unauthorized actions, and exposure of sensitive registry information. The impact is limited to confidentiality and integrity with no availability impact.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-102295 for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on untrusted links, especially when logged into Red Hat Quay 3.