{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-102295","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","state":"PUBLISHED","assignerShortName":"redhat","dateReserved":"2026-09-28T20:56:50.471Z","datePublished":"2026-10-05T17:02:45.778Z","dateUpdated":"2026-10-05T18:37:54.506Z"},"containers":{"cna":{"title":"Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter","metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"format":"CVSS"}],"descriptions":[{"lang":"en","value":"A flaw was found in Quay. A cross-site scripting (XSS) vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper input sanitization to run client-side scripts in the application context. Successful exploitation could allow the attacker to compromise the user's session, access sensitive registry information, or perform unauthorized actions on their behalf."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Quay 3","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"quay/quay-rhel9","defaultStatus":"affected","cpes":["cpe:/a:redhat:quay:3"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-102295","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2542699","name":"RHBZ#2542699","tags":["issue-tracking","x_refsource_REDHAT"]}],"datePublic":"2026-09-28T20:57:00.000Z","problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"x_redhatCweChain":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"timeline":[{"lang":"en","time":"2026-09-28T19:45:14.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-09-28T20:57:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Shashank (CredShields) for reporting this issue."}],"providerMetadata":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-05T17:02:45.778Z"},"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-05T18:37:46.129521Z","id":"CVE-2026-102295","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-05T18:37:54.506Z"}}]}}