A DOM-based cross-site scripting (XSS) flaw was found in Project Quay's OAuth local callback handler (OAuthLocalHandler.tsx). When the format=json query parameter is supplied, the component reads the access_token from the URL fragment and assigns it to document.body.innerHTML via JSON.stringify, which does not HTML-encode angle brackets. An attacker can craft a URL containing a malicious access_token in the fragment that, when clicked by a Quay user, executes arbitrary JavaScript in the Quay registry origin. The format=json code path bypasses OAuth state validation and requires no authentication.