A DOM-based cross-site scripting flaw was found in Project Quay's signin page (Signin.tsx). After a user completes a successful direct database login, the component reads the redirect_url query parameter and assigns it to window.location.href without validating the URL scheme or origin. An attacker can set redirect_url to a javascript: URI, causing arbitrary JavaScript execution in the authenticated Quay session after login. Exploitation requires the target deployment to use database authentication and the user to successfully authenticate through the crafted URL.