A flaw was found in Red Hat Quay's external LDAP authentication handling. When an LDAP referral is returned during authentication, the referral handler at data/users/externalldap.py:700 constructs a search filter using the raw username_or_email input without applying escape_filter_chars(), unlike the normal authentication path which correctly escapes the input. This allows LDAP filter metacharacters (*, (, )) in the username to be injected into the referral path's search filter. While SCOPE_BASE limits the search to a single DN (preventing directory enumeration) and a separate simple_bind_s password check prevents direct authentication bypass, an attacker could use this to perform user-existence oracle attacks at the referral DN and potentially influence which DN enters the password bind in multi-domain Active Directory environments.