Bug 2543208 (CVE-2026-102576)

Summary: CVE-2026-102576 quay: quay: DOM-based cross-site scripting via unvalidated redirect_url on signin page
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: doconnor
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting (XSS). Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of the victim's authenticated browser session. Successful exploitation requires the target Quay deployment to use direct database authentication and the victim to complete login through the malicious URL.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-29 13:58:50 UTC 
A DOM-based cross-site scripting flaw was found in Project Quay's signin page (Signin.tsx). After a user completes a successful direct database login, the component reads the redirect_url query parameter and assigns it to window.location.href without validating the URL scheme or origin. An attacker can set redirect_url to a javascript: URI, causing arbitrary JavaScript execution in the authenticated Quay session after login. Exploitation requires the target deployment to use database authentication and the user to successfully authenticate through the crafted URL.